/mandos/release : revision 237.7.317

1

#!/usr/bin/python

1

#!/usr/bin/python2.7

2

# -*- mode: python; coding: utf-8 -*-

3

#

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

12

#

13

# Everything else is

14

15

16

#

17

# This file is part of Mandos.

18

#

19

# Mandos is free software: you can redistribute it and/or modify it

20

# under the terms of the GNU General Public License as published by

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

21

19

# the Free Software Foundation, either version 3 of the License, or

22

20

# (at your option) any later version.

23

21

#

24

# Mandos is distributed in the hope that it will be useful, but

25

# WITHOUT ANY WARRANTY; without even the implied warranty of

22

# This program is distributed in the hope that it will be useful,

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

26

24

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

27

25

# GNU General Public License for more details.

28

#

26

#

29

27

# You should have received a copy of the GNU General Public License

30

# along with Mandos. If not, see <http://www.gnu.org/licenses/>.

31

#

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

32

31

# Contact the authors at <mandos@recompile.se>.

33

#

32

#

34

33

35

34

from __future__ import (division, absolute_import, print_function,

36

35

unicode_literals)

37

36

38

try:

39

from future_builtins import *

40

except ImportError:

41

pass

37

from future_builtins import *

42

38

43

39

try:

44

40

import SocketServer as socketserver

48

44

import argparse

49

45

import datetime

50

46

import errno

47

import gnutls.crypto

48

import gnutls.connection

49

import gnutls.errors

50

import gnutls.library.functions

51

import gnutls.library.constants

52

import gnutls.library.types

51

53

try:

52

54

import ConfigParser as configparser

53

55

except ImportError:

80

82

81

83

import dbus

82

84

import dbus.service

83

import gi

84

from gi.repository import GLib

85

try:

86

import gobject

87

except ImportError:

88

from gi.repository import GObject as gobject

89

import avahi

85

90

from dbus.mainloop.glib import DBusGMainLoop

86

91

import ctypes

87

92

import ctypes.util

88

93

import xml.dom.minidom

89

94

import inspect

90

95

91

# Try to find the value of SO_BINDTODEVICE:

92

96

try:

93

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

94

# newer, and it is also the most natural place for it:

95

97

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

96

98

except AttributeError:

97

99

try:

98

# This is where SO_BINDTODEVICE was up to and including Python

99

# 2.6, and also 3.2:

100

from IN import SO_BINDTODEVICE

101

except ImportError:

102

# In Python 2.7 it seems to have been removed entirely.

103

# Try running the C preprocessor:

104

try:

105

cc = subprocess.Popen(["cc", "--language=c", "-E",

106

"/dev/stdin"],

107

stdin=subprocess.PIPE,

108

stdout=subprocess.PIPE)

109

stdout = cc.communicate(

110

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

111

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

112

except (OSError, ValueError, IndexError):

113

# No value found

114

SO_BINDTODEVICE = None

102

SO_BINDTODEVICE = None

115

103

116

104

if sys.version_info.major == 2:

117

105

str = unicode

118

106

119

if sys.version_info < (3, 2):

120

configparser.Configparser = configparser.SafeConfigParser

121

122

version = "1.8.5"

107

version = "1.6.9"

123

108

stored_state_file = "clients.pickle"

124

109

125

110

logger = logging.getLogger()

129

114

if_nametoindex = ctypes.cdll.LoadLibrary(

130

115

ctypes.util.find_library("c")).if_nametoindex

131

116

except (OSError, AttributeError):

132

117

133

118

def if_nametoindex(interface):

134

119

"Get an interface index the hard way, i.e. using fcntl()"

135

120

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

140

125

return interface_index

141

126

142

127

143

def copy_function(func):

144

"""Make a copy of a function"""

145

if sys.version_info.major == 2:

146

return types.FunctionType(func.func_code,

147

func.func_globals,

148

func.func_name,

149

func.func_defaults,

150

func.func_closure)

151

else:

152

return types.FunctionType(func.__code__,

153

func.__globals__,

154

func.__name__,

155

func.__defaults__,

156

func.__closure__)

157

158

159

128

def initlogger(debug, level=logging.WARNING):

160

129

"""init logger and add loglevel"""

161

130

162

131

global syslogger

163

132

syslogger = (logging.handlers.SysLogHandler(

164

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

165

address="/dev/log"))

133

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

134

address = "/dev/log"))

166

135

syslogger.setFormatter(logging.Formatter

167

136

('Mandos [%(process)d]: %(levelname)s:'

168

137

' %(message)s'))

169

138

logger.addHandler(syslogger)

170

139

171

140

if debug:

172

141

console = logging.StreamHandler()

173

142

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

185

154

186

155

class PGPEngine(object):

187

156

"""A simple class for OpenPGP symmetric encryption & decryption"""

188

157

189

158

def __init__(self):

190

159

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

191

self.gpg = "gpg"

192

try:

193

output = subprocess.check_output(["gpgconf"])

194

for line in output.splitlines():

195

name, text, path = line.split(b":")

196

if name == "gpg":

197

self.gpg = path

198

break

199

except OSError as e:

200

if e.errno != errno.ENOENT:

201

raise

202

160

self.gnupgargs = ['--batch',

203

'--homedir', self.tempdir,

161

'--home', self.tempdir,

204

162

'--force-mdc',

205

'--quiet']

206

# Only GPG version 1 has the --no-use-agent option.

207

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

208

self.gnupgargs.append("--no-use-agent")

209

163

'--quiet',

164

'--no-use-agent']

165

210

166

def __enter__(self):

211

167

return self

212

168

213

169

def __exit__(self, exc_type, exc_value, traceback):

214

170

self._cleanup()

215

171

return False

216

172

217

173

def __del__(self):

218

174

self._cleanup()

219

175

220

176

def _cleanup(self):

221

177

if self.tempdir is not None:

222

178

# Delete contents of tempdir

223

179

for root, dirs, files in os.walk(self.tempdir,

224

topdown=False):

180

topdown = False):

225

181

for filename in files:

226

182

os.remove(os.path.join(root, filename))

227

183

for dirname in dirs:

229

185

# Remove tempdir

230

186

os.rmdir(self.tempdir)

231

187

self.tempdir = None

232

188

233

189

def password_encode(self, password):

234

190

# Passphrase can not be empty and can not contain newlines or

235

191

# NUL bytes. So we prefix it and hex encode it.

240

196

.replace(b"\n", b"\\n")

241

197

.replace(b"\0", b"\\x00"))

242

198

return encoded

243

199

244

200

def encrypt(self, data, password):

245

201

passphrase = self.password_encode(password)

246

202

with tempfile.NamedTemporaryFile(

247

203

dir=self.tempdir) as passfile:

248

204

passfile.write(passphrase)

249

205

passfile.flush()

250

proc = subprocess.Popen([self.gpg, '--symmetric',

206

proc = subprocess.Popen(['gpg', '--symmetric',

251

207

'--passphrase-file',

252

208

passfile.name]

253

209

+ self.gnupgargs,

254

stdin=subprocess.PIPE,

255

stdout=subprocess.PIPE,

256

stderr=subprocess.PIPE)

257

ciphertext, err = proc.communicate(input=data)

210

stdin = subprocess.PIPE,

211

stdout = subprocess.PIPE,

212

stderr = subprocess.PIPE)

213

ciphertext, err = proc.communicate(input = data)

258

214

if proc.returncode != 0:

259

215

raise PGPError(err)

260

216

return ciphertext

261

217

262

218

def decrypt(self, data, password):

263

219

passphrase = self.password_encode(password)

264

220

with tempfile.NamedTemporaryFile(

265

dir=self.tempdir) as passfile:

221

dir = self.tempdir) as passfile:

266

222

passfile.write(passphrase)

267

223

passfile.flush()

268

proc = subprocess.Popen([self.gpg, '--decrypt',

224

proc = subprocess.Popen(['gpg', '--decrypt',

269

225

'--passphrase-file',

270

226

passfile.name]

271

227

+ self.gnupgargs,

272

stdin=subprocess.PIPE,

273

stdout=subprocess.PIPE,

274

stderr=subprocess.PIPE)

275

decrypted_plaintext, err = proc.communicate(input=data)

228

stdin = subprocess.PIPE,

229

stdout = subprocess.PIPE,

230

stderr = subprocess.PIPE)

231

decrypted_plaintext, err = proc.communicate(input = data)

276

232

if proc.returncode != 0:

277

233

raise PGPError(err)

278

234

return decrypted_plaintext

279

235

280

236

281

# Pretend that we have an Avahi module

282

class avahi(object):

283

"""This isn't so much a class as it is a module-like namespace."""

284

IF_UNSPEC = -1 # avahi-common/address.h

285

PROTO_UNSPEC = -1 # avahi-common/address.h

286

PROTO_INET = 0 # avahi-common/address.h

287

PROTO_INET6 = 1 # avahi-common/address.h

288

DBUS_NAME = "org.freedesktop.Avahi"

289

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

290

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

291

DBUS_PATH_SERVER = "/"

292

293

@staticmethod

294

def string_array_to_txt_array(t):

295

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

296

for s in t), signature="ay")

297

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

298

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

299

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

300

SERVER_INVALID = 0 # avahi-common/defs.h

301

SERVER_REGISTERING = 1 # avahi-common/defs.h

302

SERVER_RUNNING = 2 # avahi-common/defs.h

303

SERVER_COLLISION = 3 # avahi-common/defs.h

304

SERVER_FAILURE = 4 # avahi-common/defs.h

305

306

307

237

class AvahiError(Exception):

308

238

def __init__(self, value, *args, **kwargs):

309

239

self.value = value

321

251

322

252

class AvahiService(object):

323

253

"""An Avahi (Zeroconf) service.

324

254

325

255

Attributes:

326

256

interface: integer; avahi.IF_UNSPEC or an interface index.

327

257

Used to optionally bind to the specified interface.

339

269

server: D-Bus Server

340

270

bus: dbus.SystemBus()

341

271

"""

342

272

343

273

def __init__(self,

344

interface=avahi.IF_UNSPEC,

345

name=None,

346

servicetype=None,

347

port=None,

348

TXT=None,

349

domain="",

350

host="",

351

max_renames=32768,

352

protocol=avahi.PROTO_UNSPEC,

353

bus=None):

274

interface = avahi.IF_UNSPEC,

275

name = None,

276

servicetype = None,

277

port = None,

278

TXT = None,

279

domain = "",

280

host = "",

281

max_renames = 32768,

282

protocol = avahi.PROTO_UNSPEC,

283

bus = None):

354

284

self.interface = interface

355

285

self.name = name

356

286

self.type = servicetype

365

295

self.server = None

366

296

self.bus = bus

367

297

self.entry_group_state_changed_match = None

368

298

369

299

def rename(self, remove=True):

370

300

"""Derived from the Avahi example code"""

371

301

if self.rename_count >= self.max_renames:

391

321

logger.critical("D-Bus Exception", exc_info=error)

392

322

self.cleanup()

393

323

os._exit(1)

394

324

395

325

def remove(self):

396

326

"""Derived from the Avahi example code"""

397

327

if self.entry_group_state_changed_match is not None:

399

329

self.entry_group_state_changed_match = None

400

330

if self.group is not None:

401

331

self.group.Reset()

402

332

403

333

def add(self):

404

334

"""Derived from the Avahi example code"""

405

335

self.remove()

422

352

dbus.UInt16(self.port),

423

353

avahi.string_array_to_txt_array(self.TXT))

424

354

self.group.Commit()

425

355

426

356

def entry_group_state_changed(self, state, error):

427

357

"""Derived from the Avahi example code"""

428

358

logger.debug("Avahi entry group state change: %i", state)

429

359

430

360

if state == avahi.ENTRY_GROUP_ESTABLISHED:

431

361

logger.debug("Zeroconf service established.")

432

362

elif state == avahi.ENTRY_GROUP_COLLISION:

436

366

logger.critical("Avahi: Error in group state changed %s",

437

367

str(error))

438

368

raise AvahiGroupError("State changed: {!s}".format(error))

439

369

440

370

def cleanup(self):

441

371

"""Derived from the Avahi example code"""

442

372

if self.group is not None:

447

377

pass

448

378

self.group = None

449

379

self.remove()

450

380

451

381

def server_state_changed(self, state, error=None):

452

382

"""Derived from the Avahi example code"""

453

383

logger.debug("Avahi server state change: %i", state)

482

412

logger.debug("Unknown state: %r", state)

483

413

else:

484

414

logger.debug("Unknown state: %r: %r", state, error)

485

415

486

416

def activate(self):

487

417

"""Derived from the Avahi example code"""

488

418

if self.server is None:

499

429

class AvahiServiceToSyslog(AvahiService):

500

430

def rename(self, *args, **kwargs):

501

431

"""Add the new name to the syslog messages"""

502

ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)

432

ret = AvahiService.rename(self, *args, **kwargs)

503

433

syslogger.setFormatter(logging.Formatter(

504

434

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

505

435

.format(self.name)))

506

436

return ret

507

437

508

509

# Pretend that we have a GnuTLS module

510

class gnutls(object):

511

"""This isn't so much a class as it is a module-like namespace."""

512

513

library = ctypes.util.find_library("gnutls")

514

if library is None:

515

library = ctypes.util.find_library("gnutls-deb0")

516

_library = ctypes.cdll.LoadLibrary(library)

517

del library

518

519

# Unless otherwise indicated, the constants and types below are

520

# all from the gnutls/gnutls.h C header file.

521

522

# Constants

523

E_SUCCESS = 0

524

E_INTERRUPTED = -52

525

E_AGAIN = -28

526

CRT_OPENPGP = 2

527

CRT_RAWPK = 3

528

CLIENT = 2

529

SHUT_RDWR = 0

530

CRD_CERTIFICATE = 1

531

E_NO_CERTIFICATE_FOUND = -49

532

X509_FMT_DER = 0

533

NO_TICKETS = 1<<10

534

ENABLE_RAWPK = 1<<18

535

CTYPE_PEERS = 3

536

KEYID_USE_SHA256 = 1 # gnutls/x509.h

537

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

538

539

# Types

540

class session_int(ctypes.Structure):

541

_fields_ = []

542

session_t = ctypes.POINTER(session_int)

543

544

class certificate_credentials_st(ctypes.Structure):

545

_fields_ = []

546

certificate_credentials_t = ctypes.POINTER(

547

certificate_credentials_st)

548

certificate_type_t = ctypes.c_int

549

550

class datum_t(ctypes.Structure):

551

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

552

('size', ctypes.c_uint)]

553

554

class openpgp_crt_int(ctypes.Structure):

555

_fields_ = []

556

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

557

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

558

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

559

credentials_type_t = ctypes.c_int

560

transport_ptr_t = ctypes.c_void_p

561

close_request_t = ctypes.c_int

562

563

# Exceptions

564

class Error(Exception):

565

def __init__(self, message=None, code=None, args=()):

566

# Default usage is by a message string, but if a return

567

# code is passed, convert it to a string with

568

# gnutls.strerror()

569

self.code = code

570

if message is None and code is not None:

571

message = gnutls.strerror(code)

572

return super(gnutls.Error, self).__init__(

573

message, *args)

574

575

class CertificateSecurityError(Error):

576

pass

577

578

# Classes

579

class Credentials(object):

580

def __init__(self):

581

self._c_object = gnutls.certificate_credentials_t()

582

gnutls.certificate_allocate_credentials(

583

ctypes.byref(self._c_object))

584

self.type = gnutls.CRD_CERTIFICATE

585

586

def __del__(self):

587

gnutls.certificate_free_credentials(self._c_object)

588

589

class ClientSession(object):

590

def __init__(self, socket, credentials=None):

591

self._c_object = gnutls.session_t()

592

gnutls_flags = gnutls.CLIENT

593

if gnutls.check_version(b"3.5.6"):

594

gnutls_flags |= gnutls.NO_TICKETS

595

if gnutls.has_rawpk:

596

gnutls_flags |= gnutls.ENABLE_RAWPK

597

gnutls.init(ctypes.byref(self._c_object), gnutls_flags)

598

del gnutls_flags

599

gnutls.set_default_priority(self._c_object)

600

gnutls.transport_set_ptr(self._c_object, socket.fileno())

601

gnutls.handshake_set_private_extensions(self._c_object,

602

True)

603

self.socket = socket

604

if credentials is None:

605

credentials = gnutls.Credentials()

606

gnutls.credentials_set(self._c_object, credentials.type,

607

ctypes.cast(credentials._c_object,

608

ctypes.c_void_p))

609

self.credentials = credentials

610

611

def __del__(self):

612

gnutls.deinit(self._c_object)

613

614

def handshake(self):

615

return gnutls.handshake(self._c_object)

616

617

def send(self, data):

618

data = bytes(data)

619

data_len = len(data)

620

while data_len > 0:

621

data_len -= gnutls.record_send(self._c_object,

622

data[-data_len:],

623

data_len)

624

625

def bye(self):

626

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

627

628

# Error handling functions

629

def _error_code(result):

630

"""A function to raise exceptions on errors, suitable

631

for the 'restype' attribute on ctypes functions"""

632

if result >= 0:

633

return result

634

if result == gnutls.E_NO_CERTIFICATE_FOUND:

635

raise gnutls.CertificateSecurityError(code=result)

636

raise gnutls.Error(code=result)

637

638

def _retry_on_error(result, func, arguments):

639

"""A function to retry on some errors, suitable

640

for the 'errcheck' attribute on ctypes functions"""

641

while result < 0:

642

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

643

return _error_code(result)

644

result = func(*arguments)

645

return result

646

647

# Unless otherwise indicated, the function declarations below are

648

# all from the gnutls/gnutls.h C header file.

649

650

# Functions

651

priority_set_direct = _library.gnutls_priority_set_direct

652

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

653

ctypes.POINTER(ctypes.c_char_p)]

654

priority_set_direct.restype = _error_code

655

656

init = _library.gnutls_init

657

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

658

init.restype = _error_code

659

660

set_default_priority = _library.gnutls_set_default_priority

661

set_default_priority.argtypes = [session_t]

662

set_default_priority.restype = _error_code

663

664

record_send = _library.gnutls_record_send

665

record_send.argtypes = [session_t, ctypes.c_void_p,

666

ctypes.c_size_t]

667

record_send.restype = ctypes.c_ssize_t

668

record_send.errcheck = _retry_on_error

669

670

certificate_allocate_credentials = (

671

_library.gnutls_certificate_allocate_credentials)

672

certificate_allocate_credentials.argtypes = [

673

ctypes.POINTER(certificate_credentials_t)]

674

certificate_allocate_credentials.restype = _error_code

675

676

certificate_free_credentials = (

677

_library.gnutls_certificate_free_credentials)

678

certificate_free_credentials.argtypes = [

679

certificate_credentials_t]

680

certificate_free_credentials.restype = None

681

682

handshake_set_private_extensions = (

683

_library.gnutls_handshake_set_private_extensions)

684

handshake_set_private_extensions.argtypes = [session_t,

685

ctypes.c_int]

686

handshake_set_private_extensions.restype = None

687

688

credentials_set = _library.gnutls_credentials_set

689

credentials_set.argtypes = [session_t, credentials_type_t,

690

ctypes.c_void_p]

691

credentials_set.restype = _error_code

692

693

strerror = _library.gnutls_strerror

694

strerror.argtypes = [ctypes.c_int]

695

strerror.restype = ctypes.c_char_p

696

697

certificate_type_get = _library.gnutls_certificate_type_get

698

certificate_type_get.argtypes = [session_t]

699

certificate_type_get.restype = _error_code

700

701

certificate_get_peers = _library.gnutls_certificate_get_peers

702

certificate_get_peers.argtypes = [session_t,

703

ctypes.POINTER(ctypes.c_uint)]

704

certificate_get_peers.restype = ctypes.POINTER(datum_t)

705

706

global_set_log_level = _library.gnutls_global_set_log_level

707

global_set_log_level.argtypes = [ctypes.c_int]

708

global_set_log_level.restype = None

709

710

global_set_log_function = _library.gnutls_global_set_log_function

711

global_set_log_function.argtypes = [log_func]

712

global_set_log_function.restype = None

713

714

deinit = _library.gnutls_deinit

715

deinit.argtypes = [session_t]

716

deinit.restype = None

717

718

handshake = _library.gnutls_handshake

719

handshake.argtypes = [session_t]

720

handshake.restype = _error_code

721

handshake.errcheck = _retry_on_error

722

723

transport_set_ptr = _library.gnutls_transport_set_ptr

724

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

725

transport_set_ptr.restype = None

726

727

bye = _library.gnutls_bye

728

bye.argtypes = [session_t, close_request_t]

729

bye.restype = _error_code

730

bye.errcheck = _retry_on_error

731

732

check_version = _library.gnutls_check_version

733

check_version.argtypes = [ctypes.c_char_p]

734

check_version.restype = ctypes.c_char_p

735

736

_need_version = b"3.3.0"

737

if check_version(_need_version) is None:

738

raise self.Error("Needs GnuTLS {} or later"

739

.format(_need_version))

740

741

_tls_rawpk_version = b"3.6.6"

742

has_rawpk = bool(check_version(_tls_rawpk_version))

743

744

if has_rawpk:

745

# Types

746

class pubkey_st(ctypes.Structure):

747

_fields = []

748

pubkey_t = ctypes.POINTER(pubkey_st)

749

750

x509_crt_fmt_t = ctypes.c_int

751

752

# All the function declarations below are from gnutls/abstract.h

753

pubkey_init = _library.gnutls_pubkey_init

754

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

755

pubkey_init.restype = _error_code

756

757

pubkey_import = _library.gnutls_pubkey_import

758

pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),

759

x509_crt_fmt_t]

760

pubkey_import.restype = _error_code

761

762

pubkey_get_key_id = _library.gnutls_pubkey_get_key_id

763

pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,

764

ctypes.POINTER(ctypes.c_ubyte),

765

ctypes.POINTER(ctypes.c_size_t)]

766

pubkey_get_key_id.restype = _error_code

767

768

pubkey_deinit = _library.gnutls_pubkey_deinit

769

pubkey_deinit.argtypes = [pubkey_t]

770

pubkey_deinit.restype = None

771

else:

772

# All the function declarations below are from gnutls/openpgp.h

773

774

openpgp_crt_init = _library.gnutls_openpgp_crt_init

775

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

776

openpgp_crt_init.restype = _error_code

777

778

openpgp_crt_import = _library.gnutls_openpgp_crt_import

779

openpgp_crt_import.argtypes = [openpgp_crt_t,

780

ctypes.POINTER(datum_t),

781

openpgp_crt_fmt_t]

782

openpgp_crt_import.restype = _error_code

783

784

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

785

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

786

ctypes.POINTER(ctypes.c_uint)]

787

openpgp_crt_verify_self.restype = _error_code

788

789

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

790

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

791

openpgp_crt_deinit.restype = None

792

793

openpgp_crt_get_fingerprint = (

794

_library.gnutls_openpgp_crt_get_fingerprint)

795

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

796

ctypes.c_void_p,

797

ctypes.POINTER(

798

ctypes.c_size_t)]

799

openpgp_crt_get_fingerprint.restype = _error_code

800

801

if check_version(b"3.6.4"):

802

certificate_type_get2 = _library.gnutls_certificate_type_get2

803

certificate_type_get2.argtypes = [session_t, ctypes.c_int]

804

certificate_type_get2.restype = _error_code

805

806

# Remove non-public functions

807

del _error_code, _retry_on_error

808

809

810

438

def call_pipe(connection, # : multiprocessing.Connection

811

439

func, *args, **kwargs):

812

440

"""This function is meant to be called by multiprocessing.Process

813

441

814

442

This function runs func(*args, **kwargs), and writes the resulting

815

443

return value on the provided multiprocessing.Connection.

816

444

"""

817

445

connection.send(func(*args, **kwargs))

818

446

connection.close()

819

447

820

821

448

class Client(object):

822

449

"""A representation of a client host served by this server.

823

450

824

451

Attributes:

825

452

approved: bool(); 'None' if not yet approved/disapproved

826

453

approval_delay: datetime.timedelta(); Time to wait for approval

827

454

approval_duration: datetime.timedelta(); Duration of one approval

828

checker: multiprocessing.Process(); a running checker process used

829

to see if the client lives. 'None' if no process is

830

running.

831

checker_callback_tag: a GLib event source tag, or None

455

checker: subprocess.Popen(); a running checker process used

456

to see if the client lives.

457

'None' if no process is running.

458

checker_callback_tag: a gobject event source tag, or None

832

459

checker_command: string; External command which is run to check

833

460

if client lives. %() expansions are done at

834

461

runtime with vars(self) as dict, so that for

835

462

instance %(name)s can be used in the command.

836

checker_initiator_tag: a GLib event source tag, or None

463

checker_initiator_tag: a gobject event source tag, or None

837

464

created: datetime.datetime(); (UTC) object creation

838

465

client_structure: Object describing what attributes a client has

839

466

and is used for storing the client at exit

840

467

current_checker_command: string; current running checker_command

841

disable_initiator_tag: a GLib event source tag, or None

468

disable_initiator_tag: a gobject event source tag, or None

842

469

enabled: bool()

843

470

fingerprint: string (40 or 32 hexadecimal digits); used to

844

uniquely identify an OpenPGP client

845

key_id: string (64 hexadecimal digits); used to uniquely identify

846

a client using raw public keys

471

uniquely identify the client

847

472

host: string; available for use by the checker command

848

473

interval: datetime.timedelta(); How often to start a new checker

849

474

last_approval_request: datetime.datetime(); (UTC) or None

865

490

disabled, or None

866

491

server_settings: The server_settings dict from main()

867

492

"""

868

493

869

494

runtime_expansions = ("approval_delay", "approval_duration",

870

"created", "enabled", "expires", "key_id",

495

"created", "enabled", "expires",

871

496

"fingerprint", "host", "interval",

872

497

"last_approval_request", "last_checked_ok",

873

498

"last_enabled", "name", "timeout")

882

507

"approved_by_default": "True",

883

508

"enabled": "True",

884

509

}

885

510

886

511

@staticmethod

887

512

def config_parser(config):

888

513

"""Construct a new dict of client settings of this form:

895

520

for client_name in config.sections():

896

521

section = dict(config.items(client_name))

897

522

client = settings[client_name] = {}

898

523

899

524

client["host"] = section["host"]

900

525

# Reformat values from string types to Python types

901

526

client["approved_by_default"] = config.getboolean(

902

527

client_name, "approved_by_default")

903

528

client["enabled"] = config.getboolean(client_name,

904

529

"enabled")

905

906

# Uppercase and remove spaces from key_id and fingerprint

907

# for later comparison purposes with return value from the

908

# key_id() and fingerprint() functions

909

client["key_id"] = (section.get("key_id", "").upper()

910

.replace(" ", ""))

530

531

# Uppercase and remove spaces from fingerprint for later

532

# comparison purposes with return value from the

533

# fingerprint() function

911

534

client["fingerprint"] = (section["fingerprint"].upper()

912

535

.replace(" ", ""))

913

536

if "secret" in section:

914

client["secret"] = codecs.decode(section["secret"]

915

.encode("utf-8"),

916

"base64")

537

client["secret"] = section["secret"].decode("base64")

917

538

elif "secfile" in section:

918

539

with open(os.path.expanduser(os.path.expandvars

919

540

(section["secfile"])),

934

555

client["last_approval_request"] = None

935

556

client["last_checked_ok"] = None

936

557

client["last_checker_status"] = -2

937

558

938

559

return settings

939

940

def __init__(self, settings, name=None, server_settings=None):

560

561

def __init__(self, settings, name = None, server_settings=None):

941

562

self.name = name

942

563

if server_settings is None:

943

564

server_settings = {}

945

566

# adding all client settings

946

567

for setting, value in settings.items():

947

568

setattr(self, setting, value)

948

569

949

570

if self.enabled:

950

571

if not hasattr(self, "last_enabled"):

951

572

self.last_enabled = datetime.datetime.utcnow()

955

576

else:

956

577

self.last_enabled = None

957

578

self.expires = None

958

579

959

580

logger.debug("Creating client %r", self.name)

960

logger.debug(" Key ID: %s", self.key_id)

961

581

logger.debug(" Fingerprint: %s", self.fingerprint)

962

582

self.created = settings.get("created",

963

583

datetime.datetime.utcnow())

964

584

965

585

# attributes specific for this server instance

966

586

self.checker = None

967

587

self.checker_initiator_tag = None

973

593

self.changedstate = multiprocessing_manager.Condition(

974

594

multiprocessing_manager.Lock())

975

595

self.client_structure = [attr

976

for attr in self.__dict__.keys()

596

for attr in self.__dict__.iterkeys()

977

597

if not attr.startswith("_")]

978

598

self.client_structure.append("client_structure")

979

599

980

600

for name, t in inspect.getmembers(

981

601

type(self), lambda obj: isinstance(obj, property)):

982

602

if not name.startswith("_"):

983

603

self.client_structure.append(name)

984

604

985

605

# Send notice to process children that client state has changed

986

606

def send_changedstate(self):

987

607

with self.changedstate:

988

608

self.changedstate.notify_all()

989

609

990

610

def enable(self):

991

611

"""Start this client's checker and timeout hooks"""

992

612

if getattr(self, "enabled", False):

997

617

self.last_enabled = datetime.datetime.utcnow()

998

618

self.init_checker()

999

619

self.send_changedstate()

1000

620

1001

621

def disable(self, quiet=True):

1002

622

"""Disable this client."""

1003

623

if not getattr(self, "enabled", False):

1005

625

if not quiet:

1006

626

logger.info("Disabling client %s", self.name)

1007

627

if getattr(self, "disable_initiator_tag", None) is not None:

1008

GLib.source_remove(self.disable_initiator_tag)

628

gobject.source_remove(self.disable_initiator_tag)

1009

629

self.disable_initiator_tag = None

1010

630

self.expires = None

1011

631

if getattr(self, "checker_initiator_tag", None) is not None:

1012

GLib.source_remove(self.checker_initiator_tag)

632

gobject.source_remove(self.checker_initiator_tag)

1013

633

self.checker_initiator_tag = None

1014

634

self.stop_checker()

1015

635

self.enabled = False

1016

636

if not quiet:

1017

637

self.send_changedstate()

1018

# Do not run this again if called by a GLib.timeout_add

638

# Do not run this again if called by a gobject.timeout_add

1019

639

return False

1020

640

1021

641

def __del__(self):

1022

642

self.disable()

1023

643

1024

644

def init_checker(self):

1025

645

# Schedule a new checker to be started an 'interval' from now,

1026

646

# and every interval from then on.

1027

647

if self.checker_initiator_tag is not None:

1028

GLib.source_remove(self.checker_initiator_tag)

1029

self.checker_initiator_tag = GLib.timeout_add(

648

gobject.source_remove(self.checker_initiator_tag)

649

self.checker_initiator_tag = gobject.timeout_add(

1030

650

int(self.interval.total_seconds() * 1000),

1031

651

self.start_checker)

1032

652

# Schedule a disable() when 'timeout' has passed

1033

653

if self.disable_initiator_tag is not None:

1034

GLib.source_remove(self.disable_initiator_tag)

1035

self.disable_initiator_tag = GLib.timeout_add(

654

gobject.source_remove(self.disable_initiator_tag)

655

self.disable_initiator_tag = gobject.timeout_add(

1036

656

int(self.timeout.total_seconds() * 1000), self.disable)

1037

657

# Also start a new checker *right now*.

1038

658

self.start_checker()

1039

659

1040

660

def checker_callback(self, source, condition, connection,

1041

661

command):

1042

662

"""The checker has completed, so take appropriate actions."""

663

self.checker_callback_tag = None

664

self.checker = None

1043

665

# Read return code from connection (see call_pipe)

1044

666

returncode = connection.recv()

1045

667

connection.close()

1046

self.checker.join()

1047

self.checker_callback_tag = None

1048

self.checker = None

1049

668

1050

669

if returncode >= 0:

1051

670

self.last_checker_status = returncode

1052

671

self.last_checker_signal = None

1062

681

logger.warning("Checker for %(name)s crashed?",

1063

682

vars(self))

1064

683

return False

1065

684

1066

685

def checked_ok(self):

1067

686

"""Assert that the client has been seen, alive and well."""

1068

687

self.last_checked_ok = datetime.datetime.utcnow()

1069

688

self.last_checker_status = 0

1070

689

self.last_checker_signal = None

1071

690

self.bump_timeout()

1072

691

1073

692

def bump_timeout(self, timeout=None):

1074

693

"""Bump up the timeout for this client."""

1075

694

if timeout is None:

1076

695

timeout = self.timeout

1077

696

if self.disable_initiator_tag is not None:

1078

GLib.source_remove(self.disable_initiator_tag)

697

gobject.source_remove(self.disable_initiator_tag)

1079

698

self.disable_initiator_tag = None

1080

699

if getattr(self, "enabled", False):

1081

self.disable_initiator_tag = GLib.timeout_add(

700

self.disable_initiator_tag = gobject.timeout_add(

1082

701

int(timeout.total_seconds() * 1000), self.disable)

1083

702

self.expires = datetime.datetime.utcnow() + timeout

1084

703

1085

704

def need_approval(self):

1086

705

self.last_approval_request = datetime.datetime.utcnow()

1087

706

1088

707

def start_checker(self):

1089

708

"""Start a new checker subprocess if one is not running.

1090

709

1091

710

If a checker already exists, leave it running and do

1092

711

nothing."""

1093

712

# The reason for not killing a running checker is that if we

1098

717

# checkers alone, the checker would have to take more time

1099

718

# than 'timeout' for the client to be disabled, which is as it

1100

719

# should be.

1101

720

1102

721

if self.checker is not None and not self.checker.is_alive():

1103

722

logger.warning("Checker was not alive; joining")

1104

723

self.checker.join()

1108

727

# Escape attributes for the shell

1109

728

escaped_attrs = {

1110

729

attr: re.escape(str(getattr(self, attr)))

1111

for attr in self.runtime_expansions}

730

for attr in self.runtime_expansions }

1112

731

try:

1113

732

command = self.checker_command % escaped_attrs

1114

733

except TypeError as error:

1126

745

# The exception is when not debugging but nevertheless

1127

746

# running in the foreground; use the previously

1128

747

# created wnull.

1129

popen_args = {"close_fds": True,

1130

"shell": True,

1131

"cwd": "/"}

748

popen_args = { "close_fds": True,

749

"shell": True,

750

"cwd": "/" }

1132

751

if (not self.server_settings["debug"]

1133

752

and self.server_settings["foreground"]):

1134

753

popen_args.update({"stdout": wnull,

1135

"stderr": wnull})

1136

pipe = multiprocessing.Pipe(duplex=False)

754

"stderr": wnull })

755

pipe = multiprocessing.Pipe(duplex = False)

1137

756

self.checker = multiprocessing.Process(

1138

target=call_pipe,

1139

args=(pipe[1], subprocess.call, command),

1140

kwargs=popen_args)

757

target = call_pipe,

758

args = (pipe[1], subprocess.call, command),

759

kwargs = popen_args)

1141

760

self.checker.start()

1142

self.checker_callback_tag = GLib.io_add_watch(

1143

pipe[0].fileno(), GLib.IO_IN,

761

self.checker_callback_tag = gobject.io_add_watch(

762

pipe[0].fileno(), gobject.IO_IN,

1144

763

self.checker_callback, pipe[0], command)

1145

# Re-run this periodically if run by GLib.timeout_add

764

# Re-run this periodically if run by gobject.timeout_add

1146

765

return True

1147

766

1148

767

def stop_checker(self):

1149

768

"""Force the checker process, if any, to stop."""

1150

769

if self.checker_callback_tag:

1151

GLib.source_remove(self.checker_callback_tag)

770

gobject.source_remove(self.checker_callback_tag)

1152

771

self.checker_callback_tag = None

1153

772

if getattr(self, "checker", None) is None:

1154

773

return

1163

782

byte_arrays=False):

1164

783

"""Decorators for marking methods of a DBusObjectWithProperties to

1165

784

become properties on the D-Bus.

1166

785

1167

786

The decorated method will be called with no arguments by "Get"

1168

787

and with one argument by "Set".

1169

788

1170

789

The parameters, where they are supported, are the same as

1171

790

dbus.service.method, except there is only "signature", since the

1172

791

type from Get() and the type sent to Set() is the same.

1176

795

if byte_arrays and signature != "ay":

1177

796

raise ValueError("Byte arrays not supported for non-'ay'"

1178

797

" signature {!r}".format(signature))

1179

798

1180

799

def decorator(func):

1181

800

func._dbus_is_property = True

1182

801

func._dbus_interface = dbus_interface

1185

804

func._dbus_name = func.__name__

1186

805

if func._dbus_name.endswith("_dbus_property"):

1187

806

func._dbus_name = func._dbus_name[:-14]

1188

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

807

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1189

808

return func

1190

809

1191

810

return decorator

1192

811

1193

812

1194

813

def dbus_interface_annotations(dbus_interface):

1195

814

"""Decorator for marking functions returning interface annotations

1196

815

1197

816

Usage:

1198

817

1199

818

@dbus_interface_annotations("org.example.Interface")

1200

819

def _foo(self): # Function name does not matter

1201

820

return {"org.freedesktop.DBus.Deprecated": "true",

1202

821

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1203

822

"false"}

1204

823

"""

1205

824

1206

825

def decorator(func):

1207

826

func._dbus_is_interface = True

1208

827

func._dbus_interface = dbus_interface

1209

828

func._dbus_name = dbus_interface

1210

829

return func

1211

830

1212

831

return decorator

1213

832

1214

833

1215

834

def dbus_annotations(annotations):

1216

835

"""Decorator to annotate D-Bus methods, signals or properties

1217

836

Usage:

1218

837

1219

838

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1220

839

"org.freedesktop.DBus.Property."

1221

840

"EmitsChangedSignal": "false"})

1223

842

access="r")

1224

843

def Property_dbus_property(self):

1225

844

return dbus.Boolean(False)

1226

1227

See also the DBusObjectWithAnnotations class.

1228

845

"""

1229

846

1230

847

def decorator(func):

1231

848

func._dbus_annotations = annotations

1232

849

return func

1233

850

1234

851

return decorator

1235

852

1236

853

1252

869

pass

1253

870

1254

871

1255

class DBusObjectWithAnnotations(dbus.service.Object):

1256

"""A D-Bus object with annotations.

1257

1258

Classes inheriting from this can use the dbus_annotations

1259

decorator to add annotations to methods or signals.

872

class DBusObjectWithProperties(dbus.service.Object):

873

"""A D-Bus object with properties.

874

875

Classes inheriting from this can use the dbus_service_property

876

decorator to expose methods as D-Bus properties. It exposes the

877

standard Get(), Set(), and GetAll() methods on the D-Bus.

1260

878

"""

1261

879

1262

880

@staticmethod

1263

881

def _is_dbus_thing(thing):

1264

882

"""Returns a function testing if an attribute is a D-Bus thing

1265

883

1266

884

If called like _is_dbus_thing("method") it returns a function

1267

885

suitable for use as predicate to inspect.getmembers().

1268

886

"""

1269

887

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

1270

888

False)

1271

889

1272

890

def _get_all_dbus_things(self, thing):

1273

891

"""Returns a generator of (name, attribute) pairs

1274

892

"""

1277

895

for cls in self.__class__.__mro__

1278

896

for name, athing in

1279

897

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1280

1281

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1282

out_signature="s",

1283

path_keyword='object_path',

1284

connection_keyword='connection')

1285

def Introspect(self, object_path, connection):

1286

"""Overloading of standard D-Bus method.

1287

1288

Inserts annotation tags on methods and signals.

1289

"""

1290

xmlstring = dbus.service.Object.Introspect(self, object_path,

1291

connection)

1292

try:

1293

document = xml.dom.minidom.parseString(xmlstring)

1294

1295

for if_tag in document.getElementsByTagName("interface"):

1296

# Add annotation tags

1297

for typ in ("method", "signal"):

1298

for tag in if_tag.getElementsByTagName(typ):

1299

annots = dict()

1300

for name, prop in (self.

1301

_get_all_dbus_things(typ)):

1302

if (name == tag.getAttribute("name")

1303

and prop._dbus_interface

1304

== if_tag.getAttribute("name")):

1305

annots.update(getattr(

1306

prop, "_dbus_annotations", {}))

1307

for name, value in annots.items():

1308

ann_tag = document.createElement(

1309

"annotation")

1310

ann_tag.setAttribute("name", name)

1311

ann_tag.setAttribute("value", value)

1312

tag.appendChild(ann_tag)

1313

# Add interface annotation tags

1314

for annotation, value in dict(

1315

itertools.chain.from_iterable(

1316

annotations().items()

1317

for name, annotations

1318

in self._get_all_dbus_things("interface")

1319

if name == if_tag.getAttribute("name")

1320

)).items():

1321

ann_tag = document.createElement("annotation")

1322

ann_tag.setAttribute("name", annotation)

1323

ann_tag.setAttribute("value", value)

1324

if_tag.appendChild(ann_tag)

1325

# Fix argument name for the Introspect method itself

1326

if (if_tag.getAttribute("name")

1327

== dbus.INTROSPECTABLE_IFACE):

1328

for cn in if_tag.getElementsByTagName("method"):

1329

if cn.getAttribute("name") == "Introspect":

1330

for arg in cn.getElementsByTagName("arg"):

1331

if (arg.getAttribute("direction")

1332

== "out"):

1333

arg.setAttribute("name",

1334

"xml_data")

1335

xmlstring = document.toxml("utf-8")

1336

document.unlink()

1337

except (AttributeError, xml.dom.DOMException,

1338

xml.parsers.expat.ExpatError) as error:

1339

logger.error("Failed to override Introspection method",

1340

exc_info=error)

1341

return xmlstring

1342

1343

1344

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1345

"""A D-Bus object with properties.

1346

1347

Classes inheriting from this can use the dbus_service_property

1348

decorator to expose methods as D-Bus properties. It exposes the

1349

standard Get(), Set(), and GetAll() methods on the D-Bus.

1350

"""

1351

898

1352

899

def _get_dbus_property(self, interface_name, property_name):

1353

900

"""Returns a bound method if one exists which is a D-Bus

1354

901

property with the specified name and interface.

1359

906

if (value._dbus_name == property_name

1360

907

and value._dbus_interface == interface_name):

1361

908

return value.__get__(self)

1362

909

1363

910

# No such property

1364

911

raise DBusPropertyNotFound("{}:{}.{}".format(

1365

912

self.dbus_object_path, interface_name, property_name))

1366

1367

@classmethod

1368

def _get_all_interface_names(cls):

1369

"""Get a sequence of all interfaces supported by an object"""

1370

return (name for name in set(getattr(getattr(x, attr),

1371

"_dbus_interface", None)

1372

for x in (inspect.getmro(cls))

1373

for attr in dir(x))

1374

if name is not None)

1375

913

1376

914

@dbus.service.method(dbus.PROPERTIES_IFACE,

1377

915

in_signature="ss",

1378

916

out_signature="v")

1386

924

if not hasattr(value, "variant_level"):

1387

925

return value

1388

926

return type(value)(value, variant_level=value.variant_level+1)

1389

927

1390

928

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

1391

929

def Set(self, interface_name, property_name, value):

1392

930

"""Standard D-Bus property Set() method, see D-Bus standard.

1404

942

value = dbus.ByteArray(b''.join(chr(byte)

1405

943

for byte in value))

1406

944

prop(value)

1407

945

1408

946

@dbus.service.method(dbus.PROPERTIES_IFACE,

1409

947

in_signature="s",

1410

948

out_signature="a{sv}")

1411

949

def GetAll(self, interface_name):

1412

950

"""Standard D-Bus property GetAll() method, see D-Bus

1413

951

standard.

1414

952

1415

953

Note: Will not include properties with access="write".

1416

954

"""

1417

955

properties = {}

1428

966

properties[name] = value

1429

967

continue

1430

968

properties[name] = type(value)(

1431

value, variant_level=value.variant_level + 1)

969

value, variant_level = value.variant_level + 1)

1432

970

return dbus.Dictionary(properties, signature="sv")

1433

971

1434

972

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1435

973

def PropertiesChanged(self, interface_name, changed_properties,

1436

974

invalidated_properties):

1438

976

standard.

1439

977

"""

1440

978

pass

1441

979

1442

980

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1443

981

out_signature="s",

1444

982

path_keyword='object_path',

1445

983

connection_keyword='connection')

1446

984

def Introspect(self, object_path, connection):

1447

985

"""Overloading of standard D-Bus method.

1448

986

1449

987

Inserts property tags and interface annotation tags.

1450

988

"""

1451

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1452

object_path,

1453

connection)

989

xmlstring = dbus.service.Object.Introspect(self, object_path,

990

connection)

1454

991

try:

1455

992

document = xml.dom.minidom.parseString(xmlstring)

1456

993

1457

994

def make_tag(document, name, prop):

1458

995

e = document.createElement("property")

1459

996

e.setAttribute("name", name)

1460

997

e.setAttribute("type", prop._dbus_signature)

1461

998

e.setAttribute("access", prop._dbus_access)

1462

999

return e

1463

1000

1464

1001

for if_tag in document.getElementsByTagName("interface"):

1465

1002

# Add property tags

1466

1003

for tag in (make_tag(document, name, prop)

1469

1006

if prop._dbus_interface

1470

1007

== if_tag.getAttribute("name")):

1471

1008

if_tag.appendChild(tag)

1472

# Add annotation tags for properties

1473

for tag in if_tag.getElementsByTagName("property"):

1474

annots = dict()

1475

for name, prop in self._get_all_dbus_things(

1476

"property"):

1477

if (name == tag.getAttribute("name")

1478

and prop._dbus_interface

1479

== if_tag.getAttribute("name")):

1480

annots.update(getattr(

1481

prop, "_dbus_annotations", {}))

1482

for name, value in annots.items():

1483

ann_tag = document.createElement(

1484

"annotation")

1485

ann_tag.setAttribute("name", name)

1486

ann_tag.setAttribute("value", value)

1487

tag.appendChild(ann_tag)

1009

# Add annotation tags

1010

for typ in ("method", "signal", "property"):

1011

for tag in if_tag.getElementsByTagName(typ):

1012

annots = dict()

1013

for name, prop in (self.

1014

_get_all_dbus_things(typ)):

1015

if (name == tag.getAttribute("name")

1016

and prop._dbus_interface

1017

== if_tag.getAttribute("name")):

1018

annots.update(getattr(

1019

prop, "_dbus_annotations", {}))

1020

for name, value in annots.items():

1021

ann_tag = document.createElement(

1022

"annotation")

1023

ann_tag.setAttribute("name", name)

1024

ann_tag.setAttribute("value", value)

1025

tag.appendChild(ann_tag)

1026

# Add interface annotation tags

1027

for annotation, value in dict(

1028

itertools.chain.from_iterable(

1029

annotations().items()

1030

for name, annotations

1031

in self._get_all_dbus_things("interface")

1032

if name == if_tag.getAttribute("name")

1033

)).items():

1034

ann_tag = document.createElement("annotation")

1035

ann_tag.setAttribute("name", annotation)

1036

ann_tag.setAttribute("value", value)

1037

if_tag.appendChild(ann_tag)

1488

1038

# Add the names to the return values for the

1489

1039

# "org.freedesktop.DBus.Properties" methods

1490

1040

if (if_tag.getAttribute("name")

1509

1059

return xmlstring

1510

1060

1511

1061

1512

try:

1513

dbus.OBJECT_MANAGER_IFACE

1514

except AttributeError:

1515

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1516

1517

1518

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1519

"""A D-Bus object with an ObjectManager.

1520

1521

Classes inheriting from this exposes the standard

1522

GetManagedObjects call and the InterfacesAdded and

1523

InterfacesRemoved signals on the standard

1524

"org.freedesktop.DBus.ObjectManager" interface.

1525

1526

Note: No signals are sent automatically; they must be sent

1527

manually.

1528

"""

1529

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1530

out_signature="a{oa{sa{sv}}}")

1531

def GetManagedObjects(self):

1532

"""This function must be overridden"""

1533

raise NotImplementedError()

1534

1535

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1536

signature="oa{sa{sv}}")

1537

def InterfacesAdded(self, object_path, interfaces_and_properties):

1538

pass

1539

1540

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")

1541

def InterfacesRemoved(self, object_path, interfaces):

1542

pass

1543

1544

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1545

out_signature="s",

1546

path_keyword='object_path',

1547

connection_keyword='connection')

1548

def Introspect(self, object_path, connection):

1549

"""Overloading of standard D-Bus method.

1550

1551

Override return argument name of GetManagedObjects to be

1552

"objpath_interfaces_and_properties"

1553

"""

1554

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1555

object_path,

1556

connection)

1557

try:

1558

document = xml.dom.minidom.parseString(xmlstring)

1559

1560

for if_tag in document.getElementsByTagName("interface"):

1561

# Fix argument name for the GetManagedObjects method

1562

if (if_tag.getAttribute("name")

1563

== dbus.OBJECT_MANAGER_IFACE):

1564

for cn in if_tag.getElementsByTagName("method"):

1565

if (cn.getAttribute("name")

1566

== "GetManagedObjects"):

1567

for arg in cn.getElementsByTagName("arg"):

1568

if (arg.getAttribute("direction")

1569

== "out"):

1570

arg.setAttribute(

1571

"name",

1572

"objpath_interfaces"

1573

"_and_properties")

1574

xmlstring = document.toxml("utf-8")

1575

document.unlink()

1576

except (AttributeError, xml.dom.DOMException,

1577

xml.parsers.expat.ExpatError) as error:

1578

logger.error("Failed to override Introspection method",

1579

exc_info=error)

1580

return xmlstring

1581

1582

1583

1062

def datetime_to_dbus(dt, variant_level=0):

1584

1063

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1585

1064

if dt is None:

1586

return dbus.String("", variant_level=variant_level)

1065

return dbus.String("", variant_level = variant_level)

1587

1066

return dbus.String(dt.isoformat(), variant_level=variant_level)

1588

1067

1589

1068

1592

1071

dbus.service.Object, it will add alternate D-Bus attributes with

1593

1072

interface names according to the "alt_interface_names" mapping.

1594

1073

Usage:

1595

1074

1596

1075

@alternate_dbus_interfaces({"org.example.Interface":

1597

1076

"net.example.AlternateInterface"})

1598

1077

class SampleDBusObject(dbus.service.Object):

1599

1078

@dbus.service.method("org.example.Interface")

1600

1079

def SampleDBusMethod():

1601

1080

pass

1602

1081

1603

1082

The above "SampleDBusMethod" on "SampleDBusObject" will be

1604

1083

reachable via two interfaces: "org.example.Interface" and

1605

1084

"net.example.AlternateInterface", the latter of which will have

1606

1085

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1607

1086

"true", unless "deprecate" is passed with a False value.

1608

1087

1609

1088

This works for methods and signals, and also for D-Bus properties

1610

1089

(from DBusObjectWithProperties) and interfaces (from the

1611

1090

dbus_interface_annotations decorator).

1612

1091

"""

1613

1092

1614

1093

def wrapper(cls):

1615

1094

for orig_interface_name, alt_interface_name in (

1616

1095

alt_interface_names.items()):

1631

1110

interface_names.add(alt_interface)

1632

1111

# Is this a D-Bus signal?

1633

1112

if getattr(attribute, "_dbus_is_signal", False):

1634

# Extract the original non-method undecorated

1635

# function by black magic

1636

1113

if sys.version_info.major == 2:

1114

# Extract the original non-method undecorated

1115

# function by black magic

1637

1116

nonmethod_func = (dict(

1638

1117

zip(attribute.func_code.co_freevars,

1639

1118

attribute.__closure__))

1640

1119

["func"].cell_contents)

1641

1120

else:

1642

nonmethod_func = (dict(

1643

zip(attribute.__code__.co_freevars,

1644

attribute.__closure__))

1645

["func"].cell_contents)

1121

nonmethod_func = attribute

1646

1122

# Create a new, but exactly alike, function

1647

1123

# object, and decorate it to be a new D-Bus signal

1648

1124

# with the alternate D-Bus interface name

1649

new_function = copy_function(nonmethod_func)

1125

if sys.version_info.major == 2:

1126

new_function = types.FunctionType(

1127

nonmethod_func.func_code,

1128

nonmethod_func.func_globals,

1129

nonmethod_func.func_name,

1130

nonmethod_func.func_defaults,

1131

nonmethod_func.func_closure)

1132

else:

1133

new_function = types.FunctionType(

1134

nonmethod_func.__code__,

1135

nonmethod_func.__globals__,

1136

nonmethod_func.__name__,

1137

nonmethod_func.__defaults__,

1138

nonmethod_func.__closure__)

1650

1139

new_function = (dbus.service.signal(

1651

1140

alt_interface,

1652

1141

attribute._dbus_signature)(new_function))

1656

1145

attribute._dbus_annotations)

1657

1146

except AttributeError:

1658

1147

pass

1659

1660

1148

# Define a creator of a function to call both the

1661

1149

# original and alternate functions, so both the

1662

1150

# original and alternate signals gets sent when

1665

1153

"""This function is a scope container to pass

1666

1154

func1 and func2 to the "call_both" function

1667

1155

outside of its arguments"""

1668

1669

@functools.wraps(func2)

1156

1670

1157

def call_both(*args, **kwargs):

1671

1158

"""This function will emit two D-Bus

1672

1159

signals by calling func1 and func2"""

1673

1160

func1(*args, **kwargs)

1674

1161

func2(*args, **kwargs)

1675

# Make wrapper function look like a D-Bus

1676

# signal

1677

for name, attr in inspect.getmembers(func2):

1678

if name.startswith("_dbus_"):

1679

setattr(call_both, name, attr)

1680

1162

1681

1163

return call_both

1682

1164

# Create the "call_both" function and add it to

1683

1165

# the class

1693

1175

alt_interface,

1694

1176

attribute._dbus_in_signature,

1695

1177

attribute._dbus_out_signature)

1696

(copy_function(attribute)))

1178

(types.FunctionType(attribute.func_code,

1179

attribute.func_globals,

1180

attribute.func_name,

1181

attribute.func_defaults,

1182

attribute.func_closure)))

1697

1183

# Copy annotations, if any

1698

1184

try:

1699

1185

attr[attrname]._dbus_annotations = dict(

1711

1197

attribute._dbus_access,

1712

1198

attribute._dbus_get_args_options

1713

1199

["byte_arrays"])

1714

(copy_function(attribute)))

1200

(types.FunctionType(

1201

attribute.func_code,

1202

attribute.func_globals,

1203

attribute.func_name,

1204

attribute.func_defaults,

1205

attribute.func_closure)))

1715

1206

# Copy annotations, if any

1716

1207

try:

1717

1208

attr[attrname]._dbus_annotations = dict(

1726

1217

# to the class.

1727

1218

attr[attrname] = (

1728

1219

dbus_interface_annotations(alt_interface)

1729

(copy_function(attribute)))

1220

(types.FunctionType(attribute.func_code,

1221

attribute.func_globals,

1222

attribute.func_name,

1223

attribute.func_defaults,

1224

attribute.func_closure)))

1730

1225

if deprecate:

1731

1226

# Deprecate all alternate interfaces

1732

iname = "_AlternateDBusNames_interface_annotation{}"

1227

iname="_AlternateDBusNames_interface_annotation{}"

1733

1228

for interface_name in interface_names:

1734

1229

1735

1230

@dbus_interface_annotations(interface_name)

1736

1231

def func(self):

1737

return {"org.freedesktop.DBus.Deprecated":

1738

"true"}

1232

return { "org.freedesktop.DBus.Deprecated":

1233

"true" }

1739

1234

# Find an unused name

1740

1235

for aname in (iname.format(i)

1741

1236

for i in itertools.count()):

1745

1240

if interface_names:

1746

1241

# Replace the class with a new subclass of it with

1747

1242

# methods, signals, etc. as created above.

1748

if sys.version_info.major == 2:

1749

cls = type(b"{}Alternate".format(cls.__name__),

1750

(cls, ), attr)

1751

else:

1752

cls = type("{}Alternate".format(cls.__name__),

1753

(cls, ), attr)

1243

cls = type(b"{}Alternate".format(cls.__name__),

1244

(cls, ), attr)

1754

1245

return cls

1755

1246

1756

1247

return wrapper

1757

1248

1758

1249

1760

1251

"se.bsnet.fukt.Mandos"})

1761

1252

class ClientDBus(Client, DBusObjectWithProperties):

1762

1253

"""A Client class using D-Bus

1763

1254

1764

1255

Attributes:

1765

1256

dbus_object_path: dbus.ObjectPath

1766

1257

bus: dbus.SystemBus()

1767

1258

"""

1768

1259

1769

1260

runtime_expansions = (Client.runtime_expansions

1770

1261

+ ("dbus_object_path", ))

1771

1262

1772

1263

_interface = "se.recompile.Mandos.Client"

1773

1264

1774

1265

# dbus.service.Object doesn't use super(), so we can't either.

1775

1776

def __init__(self, bus=None, *args, **kwargs):

1266

1267

def __init__(self, bus = None, *args, **kwargs):

1777

1268

self.bus = bus

1778

1269

Client.__init__(self, *args, **kwargs)

1779

1270

# Only now, when this client is initialized, can it show up on

1785

1276

"/clients/" + client_object_name)

1786

1277

DBusObjectWithProperties.__init__(self, self.bus,

1787

1278

self.dbus_object_path)

1788

1279

1789

1280

def notifychangeproperty(transform_func, dbus_name,

1790

1281

type_func=lambda x: x,

1791

1282

variant_level=1,

1793

1284

_interface=_interface):

1794

1285

""" Modify a variable so that it's a property which announces

1795

1286

its changes to DBus.

1796

1287

1797

1288

transform_fun: Function that takes a value and a variant_level

1798

1289

and transforms it to a D-Bus type.

1799

1290

dbus_name: D-Bus name of the variable

1802

1293

variant_level: D-Bus variant level. Default: 1

1803

1294

"""

1804

1295

attrname = "_{}".format(dbus_name)

1805

1296

1806

1297

def setter(self, value):

1807

1298

if hasattr(self, "dbus_object_path"):

1808

1299

if (not hasattr(self, attrname) or

1815

1306

else:

1816

1307

dbus_value = transform_func(

1817

1308

type_func(value),

1818

variant_level=variant_level)

1309

variant_level = variant_level)

1819

1310

self.PropertyChanged(dbus.String(dbus_name),

1820

1311

dbus_value)

1821

1312

self.PropertiesChanged(

1822

1313

_interface,

1823

dbus.Dictionary({dbus.String(dbus_name):

1824

dbus_value}),

1314

dbus.Dictionary({ dbus.String(dbus_name):

1315

dbus_value }),

1825

1316

dbus.Array())

1826

1317

setattr(self, attrname, value)

1827

1318

1828

1319

return property(lambda self: getattr(self, attrname), setter)

1829

1320

1830

1321

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1831

1322

approvals_pending = notifychangeproperty(dbus.Boolean,

1832

1323

"ApprovalPending",

1833

type_func=bool)

1324

type_func = bool)

1834

1325

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1835

1326

last_enabled = notifychangeproperty(datetime_to_dbus,

1836

1327

"LastEnabled")

1837

1328

checker = notifychangeproperty(

1838

1329

dbus.Boolean, "CheckerRunning",

1839

type_func=lambda checker: checker is not None)

1330

type_func = lambda checker: checker is not None)

1840

1331

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1841

1332

"LastCheckedOK")

1842

1333

last_checker_status = notifychangeproperty(dbus.Int16,

1847

1338

"ApprovedByDefault")

1848

1339

approval_delay = notifychangeproperty(

1849

1340

dbus.UInt64, "ApprovalDelay",

1850

type_func=lambda td: td.total_seconds() * 1000)

1341

type_func = lambda td: td.total_seconds() * 1000)

1851

1342

approval_duration = notifychangeproperty(

1852

1343

dbus.UInt64, "ApprovalDuration",

1853

type_func=lambda td: td.total_seconds() * 1000)

1344

type_func = lambda td: td.total_seconds() * 1000)

1854

1345

host = notifychangeproperty(dbus.String, "Host")

1855

1346

timeout = notifychangeproperty(

1856

1347

dbus.UInt64, "Timeout",

1857

type_func=lambda td: td.total_seconds() * 1000)

1348

type_func = lambda td: td.total_seconds() * 1000)

1858

1349

extended_timeout = notifychangeproperty(

1859

1350

dbus.UInt64, "ExtendedTimeout",

1860

type_func=lambda td: td.total_seconds() * 1000)

1351

type_func = lambda td: td.total_seconds() * 1000)

1861

1352

interval = notifychangeproperty(

1862

1353

dbus.UInt64, "Interval",

1863

type_func=lambda td: td.total_seconds() * 1000)

1354

type_func = lambda td: td.total_seconds() * 1000)

1864

1355

checker_command = notifychangeproperty(dbus.String, "Checker")

1865

1356

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1866

1357

invalidate_only=True)

1867

1358

1868

1359

del notifychangeproperty

1869

1360

1870

1361

def __del__(self, *args, **kwargs):

1871

1362

try:

1872

1363

self.remove_from_connection()

1875

1366

if hasattr(DBusObjectWithProperties, "__del__"):

1876

1367

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1877

1368

Client.__del__(self, *args, **kwargs)

1878

1369

1879

1370

def checker_callback(self, source, condition,

1880

1371

connection, command, *args, **kwargs):

1881

1372

ret = Client.checker_callback(self, source, condition,

1885

1376

if exitstatus >= 0:

1886

1377

# Emit D-Bus signal

1887

1378

self.CheckerCompleted(dbus.Int16(exitstatus),

1888

# This is specific to GNU libC

1889

dbus.Int64(exitstatus << 8),

1379

dbus.Int64(0),

1890

1380

dbus.String(command))

1891

1381

else:

1892

1382

# Emit D-Bus signal

1893

1383

self.CheckerCompleted(dbus.Int16(-1),

1894

1384

dbus.Int64(

1895

# This is specific to GNU libC

1896

(exitstatus << 8)

1897

| self.last_checker_signal),

1385

self.last_checker_signal),

1898

1386

dbus.String(command))

1899

1387

return ret

1900

1388

1901

1389

def start_checker(self, *args, **kwargs):

1902

1390

old_checker_pid = getattr(self.checker, "pid", None)

1903

1391

r = Client.start_checker(self, *args, **kwargs)

1907

1395

# Emit D-Bus signal

1908

1396

self.CheckerStarted(self.current_checker_command)

1909

1397

return r

1910

1398

1911

1399

def _reset_approved(self):

1912

1400

self.approved = None

1913

1401

return False

1914

1402

1915

1403

def approve(self, value=True):

1916

1404

self.approved = value

1917

GLib.timeout_add(int(self.approval_duration.total_seconds()

1918

* 1000), self._reset_approved)

1405

gobject.timeout_add(int(self.approval_duration.total_seconds()

1406

* 1000), self._reset_approved)

1919

1407

self.send_changedstate()

1920

1921

# D-Bus methods, signals & properties

1922

1923

# Interfaces

1924

1925

# Signals

1926

1408

1409

## D-Bus methods, signals & properties

1410

1411

## Interfaces

1412

1413

## Signals

1414

1927

1415

# CheckerCompleted - signal

1928

1416

@dbus.service.signal(_interface, signature="nxs")

1929

1417

def CheckerCompleted(self, exitcode, waitstatus, command):

1930

1418

"D-Bus signal"

1931

1419

pass

1932

1420

1933

1421

# CheckerStarted - signal

1934

1422

@dbus.service.signal(_interface, signature="s")

1935

1423

def CheckerStarted(self, command):

1936

1424

"D-Bus signal"

1937

1425

pass

1938

1426

1939

1427

# PropertyChanged - signal

1940

1428

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1941

1429

@dbus.service.signal(_interface, signature="sv")

1942

1430

def PropertyChanged(self, property, value):

1943

1431

"D-Bus signal"

1944

1432

pass

1945

1433

1946

1434

# GotSecret - signal

1947

1435

@dbus.service.signal(_interface)

1948

1436

def GotSecret(self):

1951

1439

server to mandos-client

1952

1440

"""

1953

1441

pass

1954

1442

1955

1443

# Rejected - signal

1956

1444

@dbus.service.signal(_interface, signature="s")

1957

1445

def Rejected(self, reason):

1958

1446

"D-Bus signal"

1959

1447

pass

1960

1448

1961

1449

# NeedApproval - signal

1962

1450

@dbus.service.signal(_interface, signature="tb")

1963

1451

def NeedApproval(self, timeout, default):

1964

1452

"D-Bus signal"

1965

1453

return self.need_approval()

1966

1967

# Methods

1968

1454

1455

## Methods

1456

1969

1457

# Approve - method

1970

1458

@dbus.service.method(_interface, in_signature="b")

1971

1459

def Approve(self, value):

1972

1460

self.approve(value)

1973

1461

1974

1462

# CheckedOK - method

1975

1463

@dbus.service.method(_interface)

1976

1464

def CheckedOK(self):

1977

1465

self.checked_ok()

1978

1466

1979

1467

# Enable - method

1980

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1981

1468

@dbus.service.method(_interface)

1982

1469

def Enable(self):

1983

1470

"D-Bus method"

1984

1471

self.enable()

1985

1472

1986

1473

# StartChecker - method

1987

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1988

1474

@dbus.service.method(_interface)

1989

1475

def StartChecker(self):

1990

1476

"D-Bus method"

1991

1477

self.start_checker()

1992

1478

1993

1479

# Disable - method

1994

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1995

1480

@dbus.service.method(_interface)

1996

1481

def Disable(self):

1997

1482

"D-Bus method"

1998

1483

self.disable()

1999

1484

2000

1485

# StopChecker - method

2001

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2002

1486

@dbus.service.method(_interface)

2003

1487

def StopChecker(self):

2004

1488

self.stop_checker()

2005

2006

# Properties

2007

1489

1490

## Properties

1491

2008

1492

# ApprovalPending - property

2009

1493

@dbus_service_property(_interface, signature="b", access="read")

2010

1494

def ApprovalPending_dbus_property(self):

2011

1495

return dbus.Boolean(bool(self.approvals_pending))

2012

1496

2013

1497

# ApprovedByDefault - property

2014

1498

@dbus_service_property(_interface,

2015

1499

signature="b",

2018

1502

if value is None: # get

2019

1503

return dbus.Boolean(self.approved_by_default)

2020

1504

self.approved_by_default = bool(value)

2021

1505

2022

1506

# ApprovalDelay - property

2023

1507

@dbus_service_property(_interface,

2024

1508

signature="t",

2028

1512

return dbus.UInt64(self.approval_delay.total_seconds()

2029

1513

* 1000)

2030

1514

self.approval_delay = datetime.timedelta(0, 0, 0, value)

2031

1515

2032

1516

# ApprovalDuration - property

2033

1517

@dbus_service_property(_interface,

2034

1518

signature="t",

2038

1522

return dbus.UInt64(self.approval_duration.total_seconds()

2039

1523

* 1000)

2040

1524

self.approval_duration = datetime.timedelta(0, 0, 0, value)

2041

1525

2042

1526

# Name - property

2043

@dbus_annotations(

2044

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2045

1527

@dbus_service_property(_interface, signature="s", access="read")

2046

1528

def Name_dbus_property(self):

2047

1529

return dbus.String(self.name)

2048

2049

# KeyID - property

2050

@dbus_annotations(

2051

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2052

@dbus_service_property(_interface, signature="s", access="read")

2053

def KeyID_dbus_property(self):

2054

return dbus.String(self.key_id)

2055

1530

2056

1531

# Fingerprint - property

2057

@dbus_annotations(

2058

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2059

1532

@dbus_service_property(_interface, signature="s", access="read")

2060

1533

def Fingerprint_dbus_property(self):

2061

1534

return dbus.String(self.fingerprint)

2062

1535

2063

1536

# Host - property

2064

1537

@dbus_service_property(_interface,

2065

1538

signature="s",

2068

1541

if value is None: # get

2069

1542

return dbus.String(self.host)

2070

1543

self.host = str(value)

2071

1544

2072

1545

# Created - property

2073

@dbus_annotations(

2074

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2075

1546

@dbus_service_property(_interface, signature="s", access="read")

2076

1547

def Created_dbus_property(self):

2077

1548

return datetime_to_dbus(self.created)

2078

1549

2079

1550

# LastEnabled - property

2080

1551

@dbus_service_property(_interface, signature="s", access="read")

2081

1552

def LastEnabled_dbus_property(self):

2082

1553

return datetime_to_dbus(self.last_enabled)

2083

1554

2084

1555

# Enabled - property

2085

1556

@dbus_service_property(_interface,

2086

1557

signature="b",

2092

1563

self.enable()

2093

1564

else:

2094

1565

self.disable()

2095

1566

2096

1567

# LastCheckedOK - property

2097

1568

@dbus_service_property(_interface,

2098

1569

signature="s",

2102

1573

self.checked_ok()

2103

1574

return

2104

1575

return datetime_to_dbus(self.last_checked_ok)

2105

1576

2106

1577

# LastCheckerStatus - property

2107

1578

@dbus_service_property(_interface, signature="n", access="read")

2108

1579

def LastCheckerStatus_dbus_property(self):

2109

1580

return dbus.Int16(self.last_checker_status)

2110

1581

2111

1582

# Expires - property

2112

1583

@dbus_service_property(_interface, signature="s", access="read")

2113

1584

def Expires_dbus_property(self):

2114

1585

return datetime_to_dbus(self.expires)

2115

1586

2116

1587

# LastApprovalRequest - property

2117

1588

@dbus_service_property(_interface, signature="s", access="read")

2118

1589

def LastApprovalRequest_dbus_property(self):

2119

1590

return datetime_to_dbus(self.last_approval_request)

2120

1591

2121

1592

# Timeout - property

2122

1593

@dbus_service_property(_interface,

2123

1594

signature="t",

2138

1609

if (getattr(self, "disable_initiator_tag", None)

2139

1610

is None):

2140

1611

return

2141

GLib.source_remove(self.disable_initiator_tag)

2142

self.disable_initiator_tag = GLib.timeout_add(

1612

gobject.source_remove(self.disable_initiator_tag)

1613

self.disable_initiator_tag = gobject.timeout_add(

2143

1614

int((self.expires - now).total_seconds() * 1000),

2144

1615

self.disable)

2145

1616

2146

1617

# ExtendedTimeout - property

2147

1618

@dbus_service_property(_interface,

2148

1619

signature="t",

2152

1623

return dbus.UInt64(self.extended_timeout.total_seconds()

2153

1624

* 1000)

2154

1625

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2155

1626

2156

1627

# Interval - property

2157

1628

@dbus_service_property(_interface,

2158

1629

signature="t",

2165

1636

return

2166

1637

if self.enabled:

2167

1638

# Reschedule checker run

2168

GLib.source_remove(self.checker_initiator_tag)

2169

self.checker_initiator_tag = GLib.timeout_add(

1639

gobject.source_remove(self.checker_initiator_tag)

1640

self.checker_initiator_tag = gobject.timeout_add(

2170

1641

value, self.start_checker)

2171

self.start_checker() # Start one now, too

2172

1642

self.start_checker() # Start one now, too

1643

2173

1644

# Checker - property

2174

1645

@dbus_service_property(_interface,

2175

1646

signature="s",

2178

1649

if value is None: # get

2179

1650

return dbus.String(self.checker_command)

2180

1651

self.checker_command = str(value)

2181

1652

2182

1653

# CheckerRunning - property

2183

1654

@dbus_service_property(_interface,

2184

1655

signature="b",

2190

1661

self.start_checker()

2191

1662

else:

2192

1663

self.stop_checker()

2193

1664

2194

1665

# ObjectPath - property

2195

@dbus_annotations(

2196

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2197

"org.freedesktop.DBus.Deprecated": "true"})

2198

1666

@dbus_service_property(_interface, signature="o", access="read")

2199

1667

def ObjectPath_dbus_property(self):

2200

return self.dbus_object_path # is already a dbus.ObjectPath

2201

1668

return self.dbus_object_path # is already a dbus.ObjectPath

1669

2202

1670

# Secret = property

2203

@dbus_annotations(

2204

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2205

"invalidates"})

2206

1671

@dbus_service_property(_interface,

2207

1672

signature="ay",

2208

1673

access="write",

2209

1674

byte_arrays=True)

2210

1675

def Secret_dbus_property(self, value):

2211

1676

self.secret = bytes(value)

2212

1677

2213

1678

del _interface

2214

1679

2215

1680

2216

1681

class ProxyClient(object):

2217

def __init__(self, child_pipe, key_id, fpr, address):

1682

def __init__(self, child_pipe, fpr, address):

2218

1683

self._pipe = child_pipe

2219

self._pipe.send(('init', key_id, fpr, address))

1684

self._pipe.send(('init', fpr, address))

2220

1685

if not self._pipe.recv():

2221

raise KeyError(key_id or fpr)

2222

1686

raise KeyError(fpr)

1687

2223

1688

def __getattribute__(self, name):

2224

1689

if name == '_pipe':

2225

1690

return super(ProxyClient, self).__getattribute__(name)

2228

1693

if data[0] == 'data':

2229

1694

return data[1]

2230

1695

if data[0] == 'function':

2231

1696

2232

1697

def func(*args, **kwargs):

2233

1698

self._pipe.send(('funcall', name, args, kwargs))

2234

1699

return self._pipe.recv()[1]

2235

1700

2236

1701

return func

2237

1702

2238

1703

def __setattr__(self, name, value):

2239

1704

if name == '_pipe':

2240

1705

return super(ProxyClient, self).__setattr__(name, value)

2243

1708

2244

1709

class ClientHandler(socketserver.BaseRequestHandler, object):

2245

1710

"""A class to handle client connections.

2246

1711

2247

1712

Instantiated once for each connection to handle it.

2248

1713

Note: This will run in its own forked process."""

2249

1714

2250

1715

def handle(self):

2251

1716

with contextlib.closing(self.server.child_pipe) as child_pipe:

2252

1717

logger.info("TCP connection from: %s",

2253

1718

str(self.client_address))

2254

1719

logger.debug("Pipe FD: %d",

2255

1720

self.server.child_pipe.fileno())

2256

2257

session = gnutls.ClientSession(self.request)

2258

2259

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2260

# "+AES-256-CBC", "+SHA1",

2261

# "+COMP-NULL", "+CTYPE-OPENPGP",

2262

# "+DHE-DSS"))

1721

1722

session = gnutls.connection.ClientSession(

1723

self.request, gnutls.connection .X509Credentials())

1724

1725

# Note: gnutls.connection.X509Credentials is really a

1726

# generic GnuTLS certificate credentials object so long as

1727

# no X.509 keys are added to it. Therefore, we can use it

1728

# here despite using OpenPGP certificates.

1729

1730

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1731

# "+AES-256-CBC", "+SHA1",

1732

# "+COMP-NULL", "+CTYPE-OPENPGP",

1733

# "+DHE-DSS"))

2263

1734

# Use a fallback default, since this MUST be set.

2264

1735

priority = self.server.gnutls_priority

2265

1736

if priority is None:

2266

1737

priority = "NORMAL"

2267

gnutls.priority_set_direct(session._c_object,

2268

priority.encode("utf-8"),

2269

None)

2270

1738

gnutls.library.functions.gnutls_priority_set_direct(

1739

session._c_object, priority, None)

1740

2271

1741

# Start communication using the Mandos protocol

2272

1742

# Get protocol number

2273

1743

line = self.request.makefile().readline()

2278

1748

except (ValueError, IndexError, RuntimeError) as error:

2279

1749

logger.error("Unknown protocol version: %s", error)

2280

1750

return

2281

1751

2282

1752

# Start GnuTLS connection

2283

1753

try:

2284

1754

session.handshake()

2285

except gnutls.Error as error:

1755

except gnutls.errors.GNUTLSError as error:

2286

1756

logger.warning("Handshake failed: %s", error)

2287

1757

# Do not run session.bye() here: the session is not

2288

1758

# established. Just abandon the request.

2289

1759

return

2290

1760

logger.debug("Handshake succeeded")

2291

1761

2292

1762

approval_required = False

2293

1763

try:

2294

if gnutls.has_rawpk:

2295

fpr = b""

2296

try:

2297

key_id = self.key_id(

2298

self.peer_certificate(session))

2299

except (TypeError, gnutls.Error) as error:

2300

logger.warning("Bad certificate: %s", error)

2301

return

2302

logger.debug("Key ID: %s", key_id)

2303

2304

else:

2305

key_id = b""

2306

try:

2307

fpr = self.fingerprint(

2308

self.peer_certificate(session))

2309

except (TypeError, gnutls.Error) as error:

2310

logger.warning("Bad certificate: %s", error)

2311

return

2312

logger.debug("Fingerprint: %s", fpr)

2313

2314

try:

2315

client = ProxyClient(child_pipe, key_id, fpr,

1764

try:

1765

fpr = self.fingerprint(

1766

self.peer_certificate(session))

1767

except (TypeError,

1768

gnutls.errors.GNUTLSError) as error:

1769

logger.warning("Bad certificate: %s", error)

1770

return

1771

logger.debug("Fingerprint: %s", fpr)

1772

1773

try:

1774

client = ProxyClient(child_pipe, fpr,

2316

1775

self.client_address)

2317

1776

except KeyError:

2318

1777

return

2319

1778

2320

1779

if client.approval_delay:

2321

1780

delay = client.approval_delay

2322

1781

client.approvals_pending += 1

2323

1782

approval_required = True

2324

1783

2325

1784

while True:

2326

1785

if not client.enabled:

2327

1786

logger.info("Client %s is disabled",

2330

1789

# Emit D-Bus signal

2331

1790

client.Rejected("Disabled")

2332

1791

return

2333

1792

2334

1793

if client.approved or not client.approval_delay:

2335

# We are approved or approval is disabled

1794

#We are approved or approval is disabled

2336

1795

break

2337

1796

elif client.approved is None:

2338

1797

logger.info("Client %s needs approval",

2349

1808

# Emit D-Bus signal

2350

1809

client.Rejected("Denied")

2351

1810

return

2352

2353

# wait until timeout or approved

1811

1812

#wait until timeout or approved

2354

1813

time = datetime.datetime.now()

2355

1814

client.changedstate.acquire()

2356

1815

client.changedstate.wait(delay.total_seconds())

2369

1828

break

2370

1829

else:

2371

1830

delay -= time2 - time

2372

2373

try:

2374

session.send(client.secret)

2375

except gnutls.Error as error:

2376

logger.warning("gnutls send failed",

2377

exc_info=error)

2378

return

2379

1831

1832

sent_size = 0

1833

while sent_size < len(client.secret):

1834

try:

1835

sent = session.send(client.secret[sent_size:])

1836

except gnutls.errors.GNUTLSError as error:

1837

logger.warning("gnutls send failed",

1838

exc_info=error)

1839

return

1840

logger.debug("Sent: %d, remaining: %d", sent,

1841

len(client.secret) - (sent_size

1842

+ sent))

1843

sent_size += sent

1844

2380

1845

logger.info("Sending secret to %s", client.name)

2381

1846

# bump the timeout using extended_timeout

2382

1847

client.bump_timeout(client.extended_timeout)

2383

1848

if self.server.use_dbus:

2384

1849

# Emit D-Bus signal

2385

1850

client.GotSecret()

2386

1851

2387

1852

finally:

2388

1853

if approval_required:

2389

1854

client.approvals_pending -= 1

2390

1855

try:

2391

1856

session.bye()

2392

except gnutls.Error as error:

1857

except gnutls.errors.GNUTLSError as error:

2393

1858

logger.warning("GnuTLS bye failed",

2394

1859

exc_info=error)

2395

1860

2396

1861

@staticmethod

2397

1862

def peer_certificate(session):

2398

"Return the peer's certificate as a bytestring"

2399

try:

2400

cert_type = gnutls.certificate_type_get2(session._c_object,

2401

gnutls.CTYPE_PEERS)

2402

except AttributeError:

2403

cert_type = gnutls.certificate_type_get(session._c_object)

2404

if gnutls.has_rawpk:

2405

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2406

else:

2407

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2408

# If not a valid certificate type...

2409

if cert_type not in valid_cert_types:

2410

logger.info("Cert type %r not in %r", cert_type,

2411

valid_cert_types)

2412

# ...return invalid data

2413

return b""

1863

"Return the peer's OpenPGP certificate as a bytestring"

1864

# If not an OpenPGP certificate...

1865

if (gnutls.library.functions.gnutls_certificate_type_get(

1866

session._c_object)

1867

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1868

# ...do the normal thing

1869

return session.peer_certificate

2414

1870

list_size = ctypes.c_uint(1)

2415

cert_list = (gnutls.certificate_get_peers

1871

cert_list = (gnutls.library.functions

1872

.gnutls_certificate_get_peers

2416

1873

(session._c_object, ctypes.byref(list_size)))

2417

1874

if not bool(cert_list) and list_size.value != 0:

2418

raise gnutls.Error("error getting peer certificate")

1875

raise gnutls.errors.GNUTLSError("error getting peer"

1876

" certificate")

2419

1877

if list_size.value == 0:

2420

1878

return None

2421

1879

cert = cert_list[0]

2422

1880

return ctypes.string_at(cert.data, cert.size)

2423

2424

@staticmethod

2425

def key_id(certificate):

2426

"Convert a certificate bytestring to a hexdigit key ID"

2427

# New GnuTLS "datum" with the public key

2428

datum = gnutls.datum_t(

2429

ctypes.cast(ctypes.c_char_p(certificate),

2430

ctypes.POINTER(ctypes.c_ubyte)),

2431

ctypes.c_uint(len(certificate)))

2432

# XXX all these need to be created in the gnutls "module"

2433

# New empty GnuTLS certificate

2434

pubkey = gnutls.pubkey_t()

2435

gnutls.pubkey_init(ctypes.byref(pubkey))

2436

# Import the raw public key into the certificate

2437

gnutls.pubkey_import(pubkey,

2438

ctypes.byref(datum),

2439

gnutls.X509_FMT_DER)

2440

# New buffer for the key ID

2441

buf = ctypes.create_string_buffer(32)

2442

buf_len = ctypes.c_size_t(len(buf))

2443

# Get the key ID from the raw public key into the buffer

2444

gnutls.pubkey_get_key_id(pubkey,

2445

gnutls.KEYID_USE_SHA256,

2446

ctypes.cast(ctypes.byref(buf),

2447

ctypes.POINTER(ctypes.c_ubyte)),

2448

ctypes.byref(buf_len))

2449

# Deinit the certificate

2450

gnutls.pubkey_deinit(pubkey)

2451

2452

# Convert the buffer to a Python bytestring

2453

key_id = ctypes.string_at(buf, buf_len.value)

2454

# Convert the bytestring to hexadecimal notation

2455

hex_key_id = binascii.hexlify(key_id).upper()

2456

return hex_key_id

2457

1881

2458

1882

@staticmethod

2459

1883

def fingerprint(openpgp):

2460

1884

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2461

1885

# New GnuTLS "datum" with the OpenPGP public key

2462

datum = gnutls.datum_t(

1886

datum = gnutls.library.types.gnutls_datum_t(

2463

1887

ctypes.cast(ctypes.c_char_p(openpgp),

2464

1888

ctypes.POINTER(ctypes.c_ubyte)),

2465

1889

ctypes.c_uint(len(openpgp)))

2466

1890

# New empty GnuTLS certificate

2467

crt = gnutls.openpgp_crt_t()

2468

gnutls.openpgp_crt_init(ctypes.byref(crt))

1891

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1892

gnutls.library.functions.gnutls_openpgp_crt_init(

1893

ctypes.byref(crt))

2469

1894

# Import the OpenPGP public key into the certificate

2470

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2471

gnutls.OPENPGP_FMT_RAW)

1895

gnutls.library.functions.gnutls_openpgp_crt_import(

1896

crt, ctypes.byref(datum),

1897

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

2472

1898

# Verify the self signature in the key

2473

1899

crtverify = ctypes.c_uint()

2474

gnutls.openpgp_crt_verify_self(crt, 0,

2475

ctypes.byref(crtverify))

1900

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

1901

crt, 0, ctypes.byref(crtverify))

2476

1902

if crtverify.value != 0:

2477

gnutls.openpgp_crt_deinit(crt)

2478

raise gnutls.CertificateSecurityError(code

2479

=crtverify.value)

1903

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1904

raise gnutls.errors.CertificateSecurityError(

1905

"Verify failed")

2480

1906

# New buffer for the fingerprint

2481

1907

buf = ctypes.create_string_buffer(20)

2482

1908

buf_len = ctypes.c_size_t()

2483

1909

# Get the fingerprint from the certificate into the buffer

2484

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2485

ctypes.byref(buf_len))

1910

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

1911

crt, ctypes.byref(buf), ctypes.byref(buf_len))

2486

1912

# Deinit the certificate

2487

gnutls.openpgp_crt_deinit(crt)

1913

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2488

1914

# Convert the buffer to a Python bytestring

2489

1915

fpr = ctypes.string_at(buf, buf_len.value)

2490

1916

# Convert the bytestring to hexadecimal notation

2494

1920

2495

1921

class MultiprocessingMixIn(object):

2496

1922

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2497

1923

2498

1924

def sub_process_main(self, request, address):

2499

1925

try:

2500

1926

self.finish_request(request, address)

2501

1927

except Exception:

2502

1928

self.handle_error(request, address)

2503

1929

self.close_request(request)

2504

1930

2505

1931

def process_request(self, request, address):

2506

1932

"""Start a new process to process the request."""

2507

proc = multiprocessing.Process(target=self.sub_process_main,

2508

args=(request, address))

1933

proc = multiprocessing.Process(target = self.sub_process_main,

1934

args = (request, address))

2509

1935

proc.start()

2510

1936

return proc

2511

1937

2512

1938

2513

1939

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2514

1940

""" adds a pipe to the MixIn """

2515

1941

2516

1942

def process_request(self, request, client_address):

2517

1943

"""Overrides and wraps the original process_request().

2518

1944

2519

1945

This function creates a new pipe in self.pipe

2520

1946

"""

2521

1947

parent_pipe, self.child_pipe = multiprocessing.Pipe()

2522

1948

2523

1949

proc = MultiprocessingMixIn.process_request(self, request,

2524

1950

client_address)

2525

1951

self.child_pipe.close()

2526

1952

self.add_pipe(parent_pipe, proc)

2527

1953

2528

1954

def add_pipe(self, parent_pipe, proc):

2529

1955

"""Dummy function; override as necessary"""

2530

1956

raise NotImplementedError()

2533

1959

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2534

1960

socketserver.TCPServer, object):

2535

1961

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2536

1962

2537

1963

Attributes:

2538

1964

enabled: Boolean; whether this server is activated yet

2539

1965

interface: None or a network interface name (string)

2540

1966

use_ipv6: Boolean; to use IPv6 or not

2541

1967

"""

2542

1968

2543

1969

def __init__(self, server_address, RequestHandlerClass,

2544

1970

interface=None,

2545

1971

use_ipv6=True,

2555

1981

self.socketfd = socketfd

2556

1982

# Save the original socket.socket() function

2557

1983

self.socket_socket = socket.socket

2558

2559

1984

# To implement --socket, we monkey patch socket.socket.

2560

#

1985

#

2561

1986

# (When socketserver.TCPServer is a new-style class, we

2562

1987

# could make self.socket into a property instead of monkey

2563

1988

# patching socket.socket.)

2564

#

1989

#

2565

1990

# Create a one-time-only replacement for socket.socket()

2566

1991

@functools.wraps(socket.socket)

2567

1992

def socket_wrapper(*args, **kwargs):

2579

2004

# socket_wrapper(), if socketfd was set.

2580

2005

socketserver.TCPServer.__init__(self, server_address,

2581

2006

RequestHandlerClass)

2582

2007

2583

2008

def server_bind(self):

2584

2009

"""This overrides the normal server_bind() function

2585

2010

to bind to an interface if one was specified, and also NOT to

2586

2011

bind to an address or port if they were not specified."""

2587

global SO_BINDTODEVICE

2588

2012

if self.interface is not None:

2589

2013

if SO_BINDTODEVICE is None:

2590

# Fall back to a hard-coded value which seems to be

2591

# common enough.

2592

logger.warning("SO_BINDTODEVICE not found, trying 25")

2593

SO_BINDTODEVICE = 25

2594

try:

2595

self.socket.setsockopt(

2596

socket.SOL_SOCKET, SO_BINDTODEVICE,

2597

(self.interface + "\0").encode("utf-8"))

2598

except socket.error as error:

2599

if error.errno == errno.EPERM:

2600

logger.error("No permission to bind to"

2601

" interface %s", self.interface)

2602

elif error.errno == errno.ENOPROTOOPT:

2603

logger.error("SO_BINDTODEVICE not available;"

2604

" cannot bind to interface %s",

2605

self.interface)

2606

elif error.errno == errno.ENODEV:

2607

logger.error("Interface %s does not exist,"

2608

" cannot bind", self.interface)

2609

else:

2610

raise

2014

logger.error("SO_BINDTODEVICE does not exist;"

2015

" cannot bind to interface %s",

2016

self.interface)

2017

else:

2018

try:

2019

self.socket.setsockopt(

2020

socket.SOL_SOCKET, SO_BINDTODEVICE,

2021

(self.interface + "\0").encode("utf-8"))

2022

except socket.error as error:

2023

if error.errno == errno.EPERM:

2024

logger.error("No permission to bind to"

2025

" interface %s", self.interface)

2026

elif error.errno == errno.ENOPROTOOPT:

2027

logger.error("SO_BINDTODEVICE not available;"

2028

" cannot bind to interface %s",

2029

self.interface)

2030

elif error.errno == errno.ENODEV:

2031

logger.error("Interface %s does not exist,"

2032

" cannot bind", self.interface)

2033

else:

2034

raise

2611

2035

# Only bind(2) the socket if we really need to.

2612

2036

if self.server_address[0] or self.server_address[1]:

2613

if self.server_address[1]:

2614

self.allow_reuse_address = True

2615

2037

if not self.server_address[0]:

2616

2038

if self.address_family == socket.AF_INET6:

2617

any_address = "::" # in6addr_any

2039

any_address = "::" # in6addr_any

2618

2040

else:

2619

any_address = "0.0.0.0" # INADDR_ANY

2041

any_address = "0.0.0.0" # INADDR_ANY

2620

2042

self.server_address = (any_address,

2621

2043

self.server_address[1])

2622

2044

elif not self.server_address[1]:

2632

2054

2633

2055

class MandosServer(IPv6_TCPServer):

2634

2056

"""Mandos server.

2635

2057

2636

2058

Attributes:

2637

2059

clients: set of Client objects

2638

2060

gnutls_priority GnuTLS priority string

2639

2061

use_dbus: Boolean; to emit D-Bus signals or not

2640

2641

Assumes a GLib.MainLoop event loop.

2062

2063

Assumes a gobject.MainLoop event loop.

2642

2064

"""

2643

2065

2644

2066

def __init__(self, server_address, RequestHandlerClass,

2645

2067

interface=None,

2646

2068

use_ipv6=True,

2656

2078

self.gnutls_priority = gnutls_priority

2657

2079

IPv6_TCPServer.__init__(self, server_address,

2658

2080

RequestHandlerClass,

2659

interface=interface,

2660

use_ipv6=use_ipv6,

2661

socketfd=socketfd)

2662

2081

interface = interface,

2082

use_ipv6 = use_ipv6,

2083

socketfd = socketfd)

2084

2663

2085

def server_activate(self):

2664

2086

if self.enabled:

2665

2087

return socketserver.TCPServer.server_activate(self)

2666

2088

2667

2089

def enable(self):

2668

2090

self.enabled = True

2669

2091

2670

2092

def add_pipe(self, parent_pipe, proc):

2671

2093

# Call "handle_ipc" for both data and EOF events

2672

GLib.io_add_watch(

2094

gobject.io_add_watch(

2673

2095

parent_pipe.fileno(),

2674

GLib.IO_IN | GLib.IO_HUP,

2096

gobject.IO_IN | gobject.IO_HUP,

2675

2097

functools.partial(self.handle_ipc,

2676

parent_pipe=parent_pipe,

2677

proc=proc))

2678

2098

parent_pipe = parent_pipe,

2099

proc = proc))

2100

2679

2101

def handle_ipc(self, source, condition,

2680

2102

parent_pipe=None,

2681

proc=None,

2103

proc = None,

2682

2104

client_object=None):

2683

2105

# error, or the other end of multiprocessing.Pipe has closed

2684

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2106

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2685

2107

# Wait for other process to exit

2686

2108

proc.join()

2687

2109

return False

2688

2110

2689

2111

# Read a request from the child

2690

2112

request = parent_pipe.recv()

2691

2113

command = request[0]

2692

2114

2693

2115

if command == 'init':

2694

key_id = request[1].decode("ascii")

2695

fpr = request[2].decode("ascii")

2696

address = request[3]

2697

2698

for c in self.clients.values():

2699

if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":

2700

continue

2701

if key_id and c.key_id == key_id:

2702

client = c

2703

break

2704

if fpr and c.fingerprint == fpr:

2116

fpr = request[1]

2117

address = request[2]

2118

2119

for c in self.clients.itervalues():

2120

if c.fingerprint == fpr:

2705

2121

client = c

2706

2122

break

2707

2123

else:

2708

logger.info("Client not found for key ID: %s, address"

2709

": %s", key_id or fpr, address)

2124

logger.info("Client not found for fingerprint: %s, ad"

2125

"dress: %s", fpr, address)

2710

2126

if self.use_dbus:

2711

2127

# Emit D-Bus signal

2712

mandos_dbus_service.ClientNotFound(key_id or fpr,

2128

mandos_dbus_service.ClientNotFound(fpr,

2713

2129

address[0])

2714

2130

parent_pipe.send(False)

2715

2131

return False

2716

2717

GLib.io_add_watch(

2132

2133

gobject.io_add_watch(

2718

2134

parent_pipe.fileno(),

2719

GLib.IO_IN | GLib.IO_HUP,

2135

gobject.IO_IN | gobject.IO_HUP,

2720

2136

functools.partial(self.handle_ipc,

2721

parent_pipe=parent_pipe,

2722

proc=proc,

2723

client_object=client))

2137

parent_pipe = parent_pipe,

2138

proc = proc,

2139

client_object = client))

2724

2140

parent_pipe.send(True)

2725

2141

# remove the old hook in favor of the new above hook on

2726

2142

# same fileno

2729

2145

funcname = request[1]

2730

2146

args = request[2]

2731

2147

kwargs = request[3]

2732

2148

2733

2149

parent_pipe.send(('data', getattr(client_object,

2734

2150

funcname)(*args,

2735

2151

**kwargs)))

2736

2152

2737

2153

if command == 'getattr':

2738

2154

attrname = request[1]

2739

2155

if isinstance(client_object.__getattribute__(attrname),

2742

2158

else:

2743

2159

parent_pipe.send((

2744

2160

'data', client_object.__getattribute__(attrname)))

2745

2161

2746

2162

if command == 'setattr':

2747

2163

attrname = request[1]

2748

2164

value = request[2]

2749

2165

setattr(client_object, attrname, value)

2750

2166

2751

2167

return True

2752

2168

2753

2169

2754

2170

def rfc3339_duration_to_delta(duration):

2755

2171

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2756

2172

2757

2173

>>> rfc3339_duration_to_delta("P7D")

2758

2174

datetime.timedelta(7)

2759

2175

>>> rfc3339_duration_to_delta("PT60S")

2769

2185

>>> rfc3339_duration_to_delta("P1DT3M20S")

2770

2186

datetime.timedelta(1, 200)

2771

2187

"""

2772

2188

2773

2189

# Parsing an RFC 3339 duration with regular expressions is not

2774

2190

# possible - there would have to be multiple places for the same

2775

2191

# values, like seconds. The current code, while more esoteric, is

2776

2192

# cleaner without depending on a parsing library. If Python had a

2777

2193

# built-in library for parsing we would use it, but we'd like to

2778

2194

# avoid excessive use of external libraries.

2779

2195

2780

2196

# New type for defining tokens, syntax, and semantics all-in-one

2781

2197

Token = collections.namedtuple("Token", (

2782

2198

"regexp", # To match token; if "value" is not None, must have

2815

2231

frozenset((token_year, token_month,

2816

2232

token_day, token_time,

2817

2233

token_week)))

2818

# Define starting values:

2819

# Value so far

2820

value = datetime.timedelta()

2234

# Define starting values

2235

value = datetime.timedelta() # Value so far

2821

2236

found_token = None

2822

# Following valid tokens

2823

followers = frozenset((token_duration, ))

2824

# String left to parse

2825

s = duration

2237

followers = frozenset((token_duration, )) # Following valid tokens

2238

s = duration # String left to parse

2826

2239

# Loop until end token is found

2827

2240

while found_token is not token_end:

2828

2241

# Search for any currently valid tokens

2852

2265

2853

2266

def string_to_delta(interval):

2854

2267

"""Parse a string and return a datetime.timedelta

2855

2268

2856

2269

>>> string_to_delta('7d')

2857

2270

datetime.timedelta(7)

2858

2271

>>> string_to_delta('60s')

2866

2279

>>> string_to_delta('5m 30s')

2867

2280

datetime.timedelta(0, 330)

2868

2281

"""

2869

2282

2870

2283

try:

2871

2284

return rfc3339_duration_to_delta(interval)

2872

2285

except ValueError:

2873

2286

pass

2874

2287

2875

2288

timevalue = datetime.timedelta(0)

2876

2289

for s in interval.split():

2877

2290

try:

2895

2308

return timevalue

2896

2309

2897

2310

2898

def daemon(nochdir=False, noclose=False):

2311

def daemon(nochdir = False, noclose = False):

2899

2312

"""See daemon(3). Standard BSD Unix function.

2900

2313

2901

2314

This should really exist as os.daemon, but it doesn't (yet)."""

2902

2315

if os.fork():

2903

2316

sys.exit()

2921

2334

2922

2335

2923

2336

def main():

2924

2337

2925

2338

##################################################################

2926

2339

# Parsing of options, both command line and config file

2927

2340

2928

2341

parser = argparse.ArgumentParser()

2929

2342

parser.add_argument("-v", "--version", action="version",

2930

version="%(prog)s {}".format(version),

2343

version = "%(prog)s {}".format(version),

2931

2344

help="show version number and exit")

2932

2345

parser.add_argument("-i", "--interface", metavar="IF",

2933

2346

help="Bind to interface IF")

2969

2382

parser.add_argument("--no-zeroconf", action="store_false",

2970

2383

dest="zeroconf", help="Do not use Zeroconf",

2971

2384

default=None)

2972

2385

2973

2386

options = parser.parse_args()

2974

2387

2975

2388

if options.check:

2976

2389

import doctest

2977

2390

fail_count, test_count = doctest.testmod()

2978

2391

sys.exit(os.EX_OK if fail_count == 0 else 1)

2979

2392

2980

2393

# Default values for config file for server-global settings

2981

if gnutls.has_rawpk:

2982

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

2983

":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")

2984

else:

2985

priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2986

":+SIGN-DSA-SHA256")

2987

server_defaults = {"interface": "",

2988

"address": "",

2989

"port": "",

2990

"debug": "False",

2991

"priority": priority,

2992

"servicename": "Mandos",

2993

"use_dbus": "True",

2994

"use_ipv6": "True",

2995

"debuglevel": "",

2996

"restore": "True",

2997

"socket": "",

2998

"statedir": "/var/lib/mandos",

2999

"foreground": "False",

3000

"zeroconf": "True",

3001

}

3002

del priority

3003

2394

server_defaults = { "interface": "",

2395

"address": "",

2396

"port": "",

2397

"debug": "False",

2398

"priority":

2399

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2400

":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2401

"servicename": "Mandos",

2402

"use_dbus": "True",

2403

"use_ipv6": "True",

2404

"debuglevel": "",

2405

"restore": "True",

2406

"socket": "",

2407

"statedir": "/var/lib/mandos",

2408

"foreground": "False",

2409

"zeroconf": "True",

2410

}

2411

3004

2412

# Parse config file for server-global settings

3005

server_config = configparser.ConfigParser(server_defaults)

2413

server_config = configparser.SafeConfigParser(server_defaults)

3006

2414

del server_defaults

3007

2415

server_config.read(os.path.join(options.configdir, "mandos.conf"))

3008

# Convert the ConfigParser object to a dict

2416

# Convert the SafeConfigParser object to a dict

3009

2417

server_settings = server_config.defaults()

3010

2418

# Use the appropriate methods on the non-string config options

3011

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3012

"foreground", "zeroconf"):

2419

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

3013

2420

server_settings[option] = server_config.getboolean("DEFAULT",

3014

2421

option)

3015

2422

if server_settings["port"]:

3025

2432

server_settings["socket"] = os.dup(server_settings

3026

2433

["socket"])

3027

2434

del server_config

3028

2435

3029

2436

# Override the settings from the config file with command line

3030

2437

# options, if set.

3031

2438

for option in ("interface", "address", "port", "debug",

3049

2456

if server_settings["debug"]:

3050

2457

server_settings["foreground"] = True

3051

2458

# Now we have our good server settings in "server_settings"

3052

2459

3053

2460

##################################################################

3054

2461

3055

2462

if (not server_settings["zeroconf"]

3056

2463

and not (server_settings["port"]

3057

2464

or server_settings["socket"] != "")):

3058

2465

parser.error("Needs port or socket to work without Zeroconf")

3059

2466

3060

2467

# For convenience

3061

2468

debug = server_settings["debug"]

3062

2469

debuglevel = server_settings["debuglevel"]

3066

2473

stored_state_file)

3067

2474

foreground = server_settings["foreground"]

3068

2475

zeroconf = server_settings["zeroconf"]

3069

2476

3070

2477

if debug:

3071

2478

initlogger(debug, logging.DEBUG)

3072

2479

else:

3075

2482

else:

3076

2483

level = getattr(logging, debuglevel.upper())

3077

2484

initlogger(debug, level)

3078

2485

3079

2486

if server_settings["servicename"] != "Mandos":

3080

2487

syslogger.setFormatter(

3081

2488

logging.Formatter('Mandos ({}) [%(process)d]:'

3082

2489

' %(levelname)s: %(message)s'.format(

3083

2490

server_settings["servicename"])))

3084

2491

3085

2492

# Parse config file with clients

3086

client_config = configparser.ConfigParser(Client.client_defaults)

2493

client_config = configparser.SafeConfigParser(Client

2494

.client_defaults)

3087

2495

client_config.read(os.path.join(server_settings["configdir"],

3088

2496

"clients.conf"))

3089

2497

3090

2498

global mandos_dbus_service

3091

2499

mandos_dbus_service = None

3092

2500

3093

2501

socketfd = None

3094

2502

if server_settings["socket"] != "":

3095

2503

socketfd = server_settings["socket"]

3111

2519

except IOError as e:

3112

2520

logger.error("Could not open file %r", pidfilename,

3113

2521

exc_info=e)

3114

3115

for name, group in (("_mandos", "_mandos"),

3116

("mandos", "mandos"),

3117

("nobody", "nogroup")):

2522

2523

for name in ("_mandos", "mandos", "nobody"):

3118

2524

try:

3119

2525

uid = pwd.getpwnam(name).pw_uid

3120

gid = pwd.getpwnam(group).pw_gid

2526

gid = pwd.getpwnam(name).pw_gid

3121

2527

break

3122

2528

except KeyError:

3123

2529

continue

3127

2533

try:

3128

2534

os.setgid(gid)

3129

2535

os.setuid(uid)

3130

if debug:

3131

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3132

gid))

3133

2536

except OSError as error:

3134

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3135

.format(uid, gid, os.strerror(error.errno)))

3136

2537

if error.errno != errno.EPERM:

3137

2538

raise

3138

2539

3139

2540

if debug:

3140

2541

# Enable all possible GnuTLS debugging

3141

2542

3142

2543

# "Use a log level over 10 to enable all debugging options."

3143

2544

# - GnuTLS manual

3144

gnutls.global_set_log_level(11)

3145

3146

@gnutls.log_func

2545

gnutls.library.functions.gnutls_global_set_log_level(11)

2546

2547

@gnutls.library.types.gnutls_log_func

3147

2548

def debug_gnutls(level, string):

3148

2549

logger.debug("GnuTLS: %s", string[:-1])

3149

3150

gnutls.global_set_log_function(debug_gnutls)

3151

2550

2551

gnutls.library.functions.gnutls_global_set_log_function(

2552

debug_gnutls)

2553

3152

2554

# Redirect stdin so all checkers get /dev/null

3153

2555

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

3154

2556

os.dup2(null, sys.stdin.fileno())

3155

2557

if null > 2:

3156

2558

os.close(null)

3157

2559

3158

2560

# Need to fork before connecting to D-Bus

3159

2561

if not foreground:

3160

2562

# Close all input and output, do double fork, etc.

3161

2563

daemon()

3162

3163

if gi.version_info < (3, 10, 2):

3164

# multiprocessing will use threads, so before we use GLib we

3165

# need to inform GLib that threads will be used.

3166

GLib.threads_init()

3167

2564

2565

# multiprocessing will use threads, so before we use gobject we

2566

# need to inform gobject that threads will be used.

2567

gobject.threads_init()

2568

3168

2569

global main_loop

3169

2570

# From the Avahi example code

3170

2571

DBusGMainLoop(set_as_default=True)

3171

main_loop = GLib.MainLoop()

2572

main_loop = gobject.MainLoop()

3172

2573

bus = dbus.SystemBus()

3173

2574

# End of Avahi example code

3174

2575

if use_dbus:

3187

2588

if zeroconf:

3188

2589

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3189

2590

service = AvahiServiceToSyslog(

3190

name=server_settings["servicename"],

3191

servicetype="_mandos._tcp",

3192

protocol=protocol,

3193

bus=bus)

2591

name = server_settings["servicename"],

2592

servicetype = "_mandos._tcp",

2593

protocol = protocol,

2594

bus = bus)

3194

2595

if server_settings["interface"]:

3195

2596

service.interface = if_nametoindex(

3196

2597

server_settings["interface"].encode("utf-8"))

3197

2598

3198

2599

global multiprocessing_manager

3199

2600

multiprocessing_manager = multiprocessing.Manager()

3200

2601

3201

2602

client_class = Client

3202

2603

if use_dbus:

3203

client_class = functools.partial(ClientDBus, bus=bus)

3204

2604

client_class = functools.partial(ClientDBus, bus = bus)

2605

3205

2606

client_settings = Client.config_parser(client_config)

3206

2607

old_client_settings = {}

3207

2608

clients_data = {}

3208

2609

3209

2610

# This is used to redirect stdout and stderr for checker processes

3210

2611

global wnull

3211

wnull = open(os.devnull, "w") # A writable /dev/null

2612

wnull = open(os.devnull, "w") # A writable /dev/null

3212

2613

# Only used if server is running in foreground but not in debug

3213

2614

# mode

3214

2615

if debug or not foreground:

3215

2616

wnull.close()

3216

2617

3217

2618

# Get client data and settings from last running state.

3218

2619

if server_settings["restore"]:

3219

2620

try:

3220

2621

with open(stored_state_path, "rb") as stored_state:

3221

if sys.version_info.major == 2:

3222

clients_data, old_client_settings = pickle.load(

3223

stored_state)

3224

else:

3225

bytes_clients_data, bytes_old_client_settings = (

3226

pickle.load(stored_state, encoding="bytes"))

3227

# Fix bytes to strings

3228

# clients_data

3229

# .keys()

3230

clients_data = {(key.decode("utf-8")

3231

if isinstance(key, bytes)

3232

else key): value

3233

for key, value in

3234

bytes_clients_data.items()}

3235

del bytes_clients_data

3236

for key in clients_data:

3237

value = {(k.decode("utf-8")

3238

if isinstance(k, bytes) else k): v

3239

for k, v in

3240

clients_data[key].items()}

3241

clients_data[key] = value

3242

# .client_structure

3243

value["client_structure"] = [

3244

(s.decode("utf-8")

3245

if isinstance(s, bytes)

3246

else s) for s in

3247

value["client_structure"]]

3248

# .name & .host

3249

for k in ("name", "host"):

3250

if isinstance(value[k], bytes):

3251

value[k] = value[k].decode("utf-8")

3252

if "key_id" not in value:

3253

value["key_id"] = ""

3254

elif "fingerprint" not in value:

3255

value["fingerprint"] = ""

3256

# old_client_settings

3257

# .keys()

3258

old_client_settings = {

3259

(key.decode("utf-8")

3260

if isinstance(key, bytes)

3261

else key): value

3262

for key, value in

3263

bytes_old_client_settings.items()}

3264

del bytes_old_client_settings

3265

# .host

3266

for value in old_client_settings.values():

3267

if isinstance(value["host"], bytes):

3268

value["host"] = (value["host"]

3269

.decode("utf-8"))

2622

clients_data, old_client_settings = pickle.load(

2623

stored_state)

3270

2624

os.remove(stored_state_path)

3271

2625

except IOError as e:

3272

2626

if e.errno == errno.ENOENT:

3280

2634

logger.warning("Could not load persistent state: "

3281

2635

"EOFError:",

3282

2636

exc_info=e)

3283

2637

3284

2638

with PGPEngine() as pgp:

3285

2639

for client_name, client in clients_data.items():

3286

2640

# Skip removed clients

3287

2641

if client_name not in client_settings:

3288

2642

continue

3289

2643

3290

2644

# Decide which value to use after restoring saved state.

3291

2645

# We have three different values: Old config file,

3292

2646

# new config file, and saved state.

3303

2657

client[name] = value

3304

2658

except KeyError:

3305

2659

pass

3306

2660

3307

2661

# Clients who has passed its expire date can still be

3308

2662

# enabled if its last checker was successful. A Client

3309

2663

# whose checker succeeded before we stored its state is

3342

2696

client_name))

3343

2697

client["secret"] = (client_settings[client_name]

3344

2698

["secret"])

3345

2699

3346

2700

# Add/remove clients based on new changes made to config

3347

2701

for client_name in (set(old_client_settings)

3348

2702

- set(client_settings)):

3350

2704

for client_name in (set(client_settings)

3351

2705

- set(old_client_settings)):

3352

2706

clients_data[client_name] = client_settings[client_name]

3353

2707

3354

2708

# Create all client objects

3355

2709

for client_name, client in clients_data.items():

3356

2710

tcp_server.clients[client_name] = client_class(

3357

name=client_name,

3358

settings=client,

3359

server_settings=server_settings)

3360

2711

name = client_name,

2712

settings = client,

2713

server_settings = server_settings)

2714

3361

2715

if not tcp_server.clients:

3362

2716

logger.warning("No clients defined")

3363

2717

3364

2718

if not foreground:

3365

2719

if pidfile is not None:

3366

2720

pid = os.getpid()

3372

2726

pidfilename, pid)

3373

2727

del pidfile

3374

2728

del pidfilename

3375

3376

for termsig in (signal.SIGHUP, signal.SIGTERM):

3377

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3378

lambda: main_loop.quit() and False)

3379

2729

2730

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2731

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2732

3380

2733

if use_dbus:

3381

2734

3382

2735

@alternate_dbus_interfaces(

3383

{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})

3384

class MandosDBusService(DBusObjectWithObjectManager):

2736

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2737

class MandosDBusService(DBusObjectWithProperties):

3385

2738

"""A D-Bus proxy object"""

3386

2739

3387

2740

def __init__(self):

3388

2741

dbus.service.Object.__init__(self, bus, "/")

3389

2742

3390

2743

_interface = "se.recompile.Mandos"

3391

2744

2745

@dbus_interface_annotations(_interface)

2746

def _foo(self):

2747

return {

2748

"org.freedesktop.DBus.Property.EmitsChangedSignal":

2749

"false" }

2750

3392

2751

@dbus.service.signal(_interface, signature="o")

3393

2752

def ClientAdded(self, objpath):

3394

2753

"D-Bus signal"

3395

2754

pass

3396

2755

3397

2756

@dbus.service.signal(_interface, signature="ss")

3398

def ClientNotFound(self, key_id, address):

2757

def ClientNotFound(self, fingerprint, address):

3399

2758

"D-Bus signal"

3400

2759

pass

3401

3402

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3403

"true"})

2760

3404

2761

@dbus.service.signal(_interface, signature="os")

3405

2762

def ClientRemoved(self, objpath, name):

3406

2763

"D-Bus signal"

3407

2764

pass

3408

3409

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3410

"true"})

2765

3411

2766

@dbus.service.method(_interface, out_signature="ao")

3412

2767

def GetAllClients(self):

3413

2768

"D-Bus method"

3414

2769

return dbus.Array(c.dbus_object_path for c in

3415

tcp_server.clients.values())

3416

3417

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3418

"true"})

2770

tcp_server.clients.itervalues())

2771

3419

2772

@dbus.service.method(_interface,

3420

2773

out_signature="a{oa{sv}}")

3421

2774

def GetAllClientsWithProperties(self):

3422

2775

"D-Bus method"

3423

2776

return dbus.Dictionary(

3424

{c.dbus_object_path: c.GetAll(

3425

"se.recompile.Mandos.Client")

3426

for c in tcp_server.clients.values()},

2777

{ c.dbus_object_path: c.GetAll("")

2778

for c in tcp_server.clients.itervalues() },

3427

2779

signature="oa{sv}")

3428

2780

3429

2781

@dbus.service.method(_interface, in_signature="o")

3430

2782

def RemoveClient(self, object_path):

3431

2783

"D-Bus method"

3432

for c in tcp_server.clients.values():

2784

for c in tcp_server.clients.itervalues():

3433

2785

if c.dbus_object_path == object_path:

3434

2786

del tcp_server.clients[c.name]

3435

2787

c.remove_from_connection()

3436

# Don't signal the disabling

2788

# Don't signal anything except ClientRemoved

3437

2789

c.disable(quiet=True)

3438

# Emit D-Bus signal for removal

3439

self.client_removed_signal(c)

2790

# Emit D-Bus signal

2791

self.ClientRemoved(object_path, c.name)

3440

2792

return

3441

2793

raise KeyError(object_path)

3442

2794

3443

2795

del _interface

3444

3445

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3446

out_signature="a{oa{sa{sv}}}")

3447

def GetManagedObjects(self):

3448

"""D-Bus method"""

3449

return dbus.Dictionary(

3450

{client.dbus_object_path:

3451

dbus.Dictionary(

3452

{interface: client.GetAll(interface)

3453

for interface in

3454

client._get_all_interface_names()})

3455

for client in tcp_server.clients.values()})

3456

3457

def client_added_signal(self, client):

3458

"""Send the new standard signal and the old signal"""

3459

if use_dbus:

3460

# New standard signal

3461

self.InterfacesAdded(

3462

client.dbus_object_path,

3463

dbus.Dictionary(

3464

{interface: client.GetAll(interface)

3465

for interface in

3466

client._get_all_interface_names()}))

3467

# Old signal

3468

self.ClientAdded(client.dbus_object_path)

3469

3470

def client_removed_signal(self, client):

3471

"""Send the new standard signal and the old signal"""

3472

if use_dbus:

3473

# New standard signal

3474

self.InterfacesRemoved(

3475

client.dbus_object_path,

3476

client._get_all_interface_names())

3477

# Old signal

3478

self.ClientRemoved(client.dbus_object_path,

3479

client.name)

3480

2796

3481

2797

mandos_dbus_service = MandosDBusService()

3482

3483

# Save modules to variables to exempt the modules from being

3484

# unloaded before the function registered with atexit() is run.

3485

mp = multiprocessing

3486

wn = wnull

3487

2798

3488

2799

def cleanup():

3489

2800

"Cleanup function; run on exit"

3490

2801

if zeroconf:

3491

2802

service.cleanup()

3492

3493

mp.active_children()

3494

wn.close()

2803

2804

multiprocessing.active_children()

2805

wnull.close()

3495

2806

if not (tcp_server.clients or client_settings):

3496

2807

return

3497

2808

3498

2809

# Store client before exiting. Secrets are encrypted with key

3499

2810

# based on what config file has. If config file is

3500

2811

# removed/edited, old secret will thus be unrecovable.

3501

2812

clients = {}

3502

2813

with PGPEngine() as pgp:

3503

for client in tcp_server.clients.values():

2814

for client in tcp_server.clients.itervalues():

3504

2815

key = client_settings[client.name]["secret"]

3505

2816

client.encrypted_secret = pgp.encrypt(client.secret,

3506

2817

key)

3507

2818

client_dict = {}

3508

2819

3509

2820

# A list of attributes that can not be pickled

3510

2821

# + secret.

3511

exclude = {"bus", "changedstate", "secret",

3512

"checker", "server_settings"}

2822

exclude = { "bus", "changedstate", "secret",

2823

"checker", "server_settings" }

3513

2824

for name, typ in inspect.getmembers(dbus.service

3514

2825

.Object):

3515

2826

exclude.add(name)

3516

2827

3517

2828

client_dict["encrypted_secret"] = (client

3518

2829

.encrypted_secret)

3519

2830

for attr in client.client_structure:

3520

2831

if attr not in exclude:

3521

2832

client_dict[attr] = getattr(client, attr)

3522

2833

3523

2834

clients[client.name] = client_dict

3524

2835

del client_settings[client.name]["secret"]

3525

2836

3526

2837

try:

3527

2838

with tempfile.NamedTemporaryFile(

3528

2839

mode='wb',

3530

2841

prefix='clients-',

3531

2842

dir=os.path.dirname(stored_state_path),

3532

2843

delete=False) as stored_state:

3533

pickle.dump((clients, client_settings), stored_state,

3534

protocol=2)

2844

pickle.dump((clients, client_settings), stored_state)

3535

2845

tempname = stored_state.name

3536

2846

os.rename(tempname, stored_state_path)

3537

2847

except (IOError, OSError) as e:

3547

2857

logger.warning("Could not save persistent state:",

3548

2858

exc_info=e)

3549

2859

raise

3550

2860

3551

2861

# Delete all clients, and settings from config

3552

2862

while tcp_server.clients:

3553

2863

name, client = tcp_server.clients.popitem()

3554

2864

if use_dbus:

3555

2865

client.remove_from_connection()

3556

# Don't signal the disabling

2866

# Don't signal anything except ClientRemoved

3557

2867

client.disable(quiet=True)

3558

# Emit D-Bus signal for removal

3559

2868

if use_dbus:

3560

mandos_dbus_service.client_removed_signal(client)

2869

# Emit D-Bus signal

2870

mandos_dbus_service.ClientRemoved(

2871

client.dbus_object_path, client.name)

3561

2872

client_settings.clear()

3562

2873

3563

2874

atexit.register(cleanup)

3564

3565

for client in tcp_server.clients.values():

2875

2876

for client in tcp_server.clients.itervalues():

3566

2877

if use_dbus:

3567

# Emit D-Bus signal for adding

3568

mandos_dbus_service.client_added_signal(client)

2878

# Emit D-Bus signal

2879

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3569

2880

# Need to initiate checking of clients

3570

2881

if client.enabled:

3571

2882

client.init_checker()

3572

2883

3573

2884

tcp_server.enable()

3574

2885

tcp_server.server_activate()

3575

2886

3576

2887

# Find out what port we got

3577

2888

if zeroconf:

3578

2889

service.port = tcp_server.socket.getsockname()[1]

3583

2894

else: # IPv4

3584

2895

logger.info("Now listening on address %r, port %d",

3585

2896

*tcp_server.socket.getsockname())

3586

3587

# service.interface = tcp_server.socket.getsockname()[3]

3588

2897

2898

#service.interface = tcp_server.socket.getsockname()[3]

2899

3589

2900

try:

3590

2901

if zeroconf:

3591

2902

# From the Avahi example code

3596

2907

cleanup()

3597

2908

sys.exit(1)

3598

2909

# End of Avahi example code

3599

3600

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3601

lambda *args, **kwargs:

3602

(tcp_server.handle_request

3603

(*args[2:], **kwargs) or True))

3604

2910

2911

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2912

lambda *args, **kwargs:

2913

(tcp_server.handle_request

2914

(*args[2:], **kwargs) or True))

2915

3605

2916

logger.debug("Starting main loop")

3606

2917

main_loop.run()

3607

2918

except AvahiError as error: